Impact

The impact of this vulnerability is the unauthorized exfiltration of sensitive credentials to attacker-controlled infrastructure. By redirecting a legitimate client request to a malicious origin, an attacker can capture authentication tokens, enabling them to potentially impersonate the client or access protected resources on the original target system. This vulnerability affects any Node.js environment utilizing urllib for external communication. Given the automated nature of redirect following, services that interface with dynamic or third-party content are at the highest risk of accidental credential exposure.

Recommendation

• Update urllib to a patched version once available that implements header sanitization for cross-origin requests.
• Implement a wrapper or interceptor around urllib.request that checks the domain of the Location header during a redirect and strips sensitive headers if the origin changes.
• Audit applications using urllib to identify code paths where followRedirect is enabled and potentially sensitive headers (Authorization, Cookie) are passed in the options object.
• Review network egress logs for unexpected connections from your backend services to unknown or untrusted external domains.