Deno Cross-Origin Authorization Header Leak Vulnerability

A vulnerability exists in Deno's fetch() redirect handling, where the Authorization header is not properly managed during cross-origin redirects. When a request with an Authorization header is sent to one domain and the response redirects to a different domain, Deno retains the original Authorization header in the follow-up request. This behavior leaks the header's content to the second domain, contrary to the expected behavior of dropping the Authorization header in such scenarios. The issue arises because Deno does not adhere to the same-origin policy and lacks a cookie jar, leading to unintentional leakage of authenticated data across origins. This vulnerability affects Deno versions prior to 1.46.4 and 2.1.2, as well as deno_fetch versions 0.204.0 and through 0.0.1.

Impact

Exploitation of this vulnerability results in the unauthorized disclosure of Authorization header contents to a different domain during cross-origin redirects.

Reproduction

The vulnerability can be reproduced by sending a request with an Authorization header to a server that responds with a cross-origin redirect. The follow-up request to the redirected server will include the original Authorization header, demonstrating the leakage of sensitive information.

Remediation

Users can upgrade to Deno version 2.1.2 or later to address this vulnerability.