Summary
lib.url.fetch() follows redirects. On a 307 or 308 redirect httpx keeps the method and resends the request body unchanged. The cross-origin guard added for GHSA-4jc5-g844-4x33 only stripped headers, so a request body carrying a password (Keycloak password grant, OpenStack and Huawei OceanStor logins) was sent to whatever host a redirect named.
Impact
A monitored server, or anything able to answer in its place such as a reverse proxy or an open redirect, can answer a login request with a 307 or 308 to a host it controls and receive the cleartext credential. Every consumer that sends a secret in a request body is affected.
Patches
Fixed in linuxfabrik-lib 8.0.0 (commit f605259). monitoring-plugins 5.0.0 to 7.0.0 bundle an affected linuxfabrik-lib, v8.0.0 bundles a fixed one. fetch() refuses a redirect that would resend a request body to another origin and reports it instead.
Summary
lib.url.fetch()follows redirects. On a 307 or 308 redirect httpx keeps the method and resends the request body unchanged. The cross-origin guard added for GHSA-4jc5-g844-4x33 only stripped headers, so a request body carrying a password (Keycloak password grant, OpenStack and Huawei OceanStor logins) was sent to whatever host a redirect named.Impact
A monitored server, or anything able to answer in its place such as a reverse proxy or an open redirect, can answer a login request with a 307 or 308 to a host it controls and receive the cleartext credential. Every consumer that sends a secret in a request body is affected.
Patches
Fixed in linuxfabrik-lib 8.0.0 (commit f605259). monitoring-plugins 5.0.0 to 7.0.0 bundle an affected linuxfabrik-lib, v8.0.0 bundles a fixed one.
fetch()refuses a redirect that would resend a request body to another origin and reports it instead.