{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/dart/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["dio_http2_adapter"],"_cs_severities":["high"],"_cs_tags":["information-disclosure","credential-access","dart","flutter"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003edio_http2_adapter\u003c/code\u003e library, a plugin for the popular Dart \u003ccode\u003eDio\u003c/code\u003e HTTP client, contains a vulnerability that leads to sensitive information disclosure. When the library is configured to follow HTTP redirects (which is enabled by default with a limit of 5), the adapter fails to perform origin validation before re-issuing a request to a new location. Consequently, sensitive request headers, specifically \u003ccode\u003eAuthorization\u003c/code\u003e, \u003ccode\u003eCookie\u003c/code\u003e, and \u003ccode\u003eProxy-Authorization\u003c/code\u003e, are copied verbatim into the request sent to the redirect target, even if that target is on a completely different origin.\u003c/p\u003e\n\u003cp\u003eThis behavior essentially allows any malicious or compromised server that can trigger a \u003ccode\u003e3xx\u003c/code\u003e redirect to force the client to disclose authenticated session tokens or proxy credentials. The vulnerability resides in the \u003ccode\u003e_fetch\u003c/code\u003e method of the \u003ccode\u003eHttp2Adapter\u003c/code\u003e class, where header maps are preserved during the \u003ccode\u003ecopyWith\u003c/code\u003e operation without sanitization. This flaw impacts server-side Dart applications, mobile applications, and CLI tools utilizing \u003ccode\u003edio_http2_adapter\u003c/code\u003e for authenticated HTTP/2 communications.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe victim application initiates an authenticated request using \u003ccode\u003eDio\u003c/code\u003e with \u003ccode\u003eHttp2Adapter\u003c/code\u003e, including sensitive headers like \u003ccode\u003eAuthorization\u003c/code\u003e or \u003ccode\u003eCookie\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application contacts a malicious or compromised origin server that is under the attacker's control.\u003c/li\u003e\n\u003cli\u003eThe malicious server responds with an HTTP \u003ccode\u003e302 Found\u003c/code\u003e (or other \u003ccode\u003e3xx\u003c/code\u003e status) and a \u003ccode\u003eLocation\u003c/code\u003e header pointing to an attacker-controlled URI.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eHttp2Adapter\u003c/code\u003e processes the \u003ccode\u003e3xx\u003c/code\u003e response, parsing the \u003ccode\u003eLocation\u003c/code\u003e header to determine the new redirect target.\u003c/li\u003e\n\u003cli\u003eThe adapter calls \u003ccode\u003eoptions.copyWith\u003c/code\u003e to initiate the new request to the redirect URI, inadvertently cloning the full original header map into the new request options.\u003c/li\u003e\n\u003cli\u003eNo cross-origin check is performed to see if the new URI belongs to a different authority.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e_fetch\u003c/code\u003e method emits the new HTTP/2 request, now including the sensitive \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e headers, to the attacker-controlled server.\u003c/li\u003e\n\u003cli\u003eThe attacker logs the incoming request headers at the final destination, successfully exfiltrating the victim's credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized disclosure of sensitive credentials, including bearer tokens, session identifiers, and proxy authentication details. This enables attackers to impersonate the victim in subsequent requests to the original legitimate service. Given the prevalence of \u003ccode\u003eDio\u003c/code\u003e in the Dart and Flutter ecosystems, any application using \u003ccode\u003edio_http2_adapter\u003c/code\u003e with \u003ccode\u003efollowRedirects\u003c/code\u003e enabled is at risk. The lack of authentication required to perform the redirect makes this a low-complexity attack for any adversary who can intercept or host an HTTP-based service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade or patch the \u003ccode\u003edio_http2_adapter\u003c/code\u003e library logic to implement origin validation during redirect processing.\u003c/li\u003e\n\u003cli\u003eFor immediate mitigation, define a list of sensitive headers (e.g., \u003ccode\u003eAuthorization\u003c/code\u003e, \u003ccode\u003eCookie\u003c/code\u003e, \u003ccode\u003eProxy-Authorization\u003c/code\u003e) and manually remove these headers from the \u003ccode\u003eRequestOptions\u003c/code\u003e when the redirect URI differs from the original request authority.\u003c/li\u003e\n\u003cli\u003eDevelopers should ensure that their \u003ccode\u003eDio\u003c/code\u003e configurations explicitly manage redirect behavior if full library updates are delayed, though this does not replace the need for the library-level sanitization fix.\u003c/li\u003e\n\u003cli\u003eOrganizations deploying Dart-based CLI tools or backend services should audit internal codebases to confirm if \u003ccode\u003edio_http2_adapter\u003c/code\u003e is utilized for authenticated requests to untrusted or external endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:24:13Z","date_published":"2026-10-15T22:24:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dio-http2-adapter-leak/","summary":"The dio_http2_adapter library fails to sanitize Authorization, Cookie, and Proxy-Authorization headers when following cross-origin HTTP redirects, enabling credential theft.","title":"Sensitive Header Leak in dio_http2_adapter via Cross-Origin Redirects","url":"https://feed.craftedsignal.io/briefs/2026-10-dio-http2-adapter-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Dart","version":"https://jsonfeed.org/version/1.1"}