HAPI FHIR HTTP Header Leak Vulnerability in Redirects

A vulnerability exists in HAPI FHIR versions prior to 6.8.3, where the internal HTTP client improperly handles headers during redirects. When following a 30X HTTP response, headers are sent to the host specified in the Location response header, potentially leaking privacy-sensitive information or data that could be used to impersonate the client's request. This issue has been addressed in version 6.8.3.

Impact

Exploitation of this vulnerability could lead to the unintentional disclosure of sensitive information through HTTP headers, allowing for privacy violations or impersonation of the client's requests.

Remediation

Users can upgrade to HAPI FHIR version 6.8.3 or later to address this vulnerability. Instructions for updating can be found in the project's Maven repository.