CVE-2023-45289: HTTP Client Header Leakage Vulnerability

CVE-2023-45289 Overview

CVE-2023-45289 affects the Go standard library net/http package. The http.Client improperly handles sensitive headers such as Authorization and Cookie when following HTTP redirects. A maliciously crafted redirect response can cause these headers to be forwarded to an unintended destination, exposing credentials and session tokens. The flaw stems from the matching logic used to decide whether the redirect target shares a sufficient relationship with the original domain. Applications written in Go that issue authenticated HTTP requests and follow redirects are exposed until updated to a fixed Go release.

Critical Impact
A crafted HTTP redirect can leak Authorization and Cookie headers from Go-based clients to attacker-controlled hosts, enabling credential theft and session takeover.

Affected Products

Go standard library net/http package (see Go.dev Vulnerability Advisory GO-2024-2600)
NetApp products bundling affected Go versions (see NetApp Security Advisory NTAP-20240329-0006)
Any application or service compiled with a vulnerable Go toolchain that uses http.Client to follow redirects

Discovery Timeline

2024-03-05 - CVE-2023-45289 published to NVD
2024-03-08 - Public discussion on the Openwall OSS Security list and Go announcement group
2024-03-29 - NetApp Security Advisory NTAP-20240329-0006 published
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2023-45289

Vulnerability Analysis

The Go net/http client follows redirects automatically by default. To protect credentials, it strips sensitive headers when redirecting across unrelated domains while preserving them on subdomain or exact-domain redirects. For example, a redirect from foo.com to www.foo.com keeps the Authorization header, while a redirect to bar.com should drop it.

The domain-matching logic incorrectly classifies certain crafted hostnames as matching the original domain. When an attacker controls a server that the client connects to, or can influence intermediate redirect responses, they can return a Location header that bypasses the match check. The client then forwards Authorization, Cookie, and similar headers to a host the user did not authorize.

The flaw is classified as an information disclosure issue affecting confidentiality, with no impact to integrity or availability.

Root Cause

The root cause is improper input validation in the domain comparison routine used by http.Client.redirectBehavior. The function did not strictly normalize hostnames before deciding whether two domains were related, allowing attacker-controlled hostnames to satisfy the subdomain match check. The fix landed in Go change-list 569340 and is tracked at Go issue 65065.

Attack Vector

Exploitation requires the victim Go client to issue an authenticated HTTP request that the attacker can redirect. Typical scenarios include a server-side application that fetches a user-supplied URL, an API client calling a compromised or malicious endpoint, or a downstream service receiving a tainted Location header through a proxy. The attacker returns an HTTP 3xx response whose Location header points to a host that satisfies the flawed match logic. The Go client follows the redirect and replays the Authorization or Cookie header to the attacker. The attack requires network reachability and the ability to influence one redirect hop, but no user interaction beyond the original request.

No public exploit code is referenced in the advisory. Refer to the Go.dev Vulnerability Advisory for technical details of the patched code path.

Detection Methods for CVE-2023-45289

Indicators of Compromise

Outbound HTTP 3xx responses originating from upstream services whose Location header points to hosts unrelated to the request's original domain.
Application logs showing successful authenticated requests to unexpected external hostnames after a redirect chain.
Authentication server logs showing valid bearer tokens or session cookies presented from unfamiliar source IP addresses or user agents shortly after legitimate use.

Detection Strategies

Inventory Go binaries and services and compare their compiled Go version against the fixed releases listed in GO-2024-2600. Use go version -m <binary> to extract build metadata.
Run govulncheck against source trees and built binaries to flag code paths that reach the vulnerable net/http redirect logic.
Inspect egress proxy logs for redirect chains that cross domain boundaries while carrying Authorization headers.

Monitoring Recommendations

Alert on outbound HTTPS connections from server-side fetchers to hosts outside an allow-list of expected destinations.
Monitor identity providers for token replay anomalies, including reuse of short-lived tokens from new IP addresses or geographies.
Track redirect counts and target-domain entropy in application telemetry to surface unusual cross-domain redirect activity.

How to Mitigate CVE-2023-45289

Immediate Actions Required

Upgrade all affected services to Go 1.21.8 or Go 1.22.1, the releases that contain the fix announced in the Golang Announce Group post.
Rebuild and redeploy any first-party binaries, container images, and serverless functions compiled with a vulnerable Go toolchain.
Rotate long-lived credentials and session cookies used by Go-based clients that fetch attacker-influenced URLs.

Patch Information

The fix is delivered in Go 1.21.8 and Go 1.22.1. The corrected redirect handling is documented in the Go.dev Code Review Summary and tracked at Go issue 65065. Vendors that ship Go-based products, including NetApp, have issued downstream advisories such as NTAP-20240329-0006 listing affected product versions and remediation timelines.

Workarounds

Set http.Client.CheckRedirect to a custom function that rejects redirects to hosts outside an explicit allow-list, or returns http.ErrUseLastResponse to disable automatic redirect following.
Strip the Authorization and Cookie headers from the Request passed in CheckRedirect before allowing the client to proceed.
Route outbound Go HTTP traffic through an egress proxy that enforces domain allow-listing and blocks unexpected cross-domain redirects.

bash

# Verify the Go version embedded in a compiled binary
go version -m ./my-service | grep '^\sgo'

# Scan a Go module for known vulnerabilities including GO-2024-2600
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...