Authentication Leak On Redirect With Reactor Netty HttpClient

According to the NVD entry [1], the HttpClient from Reactor Netty versions 0.9.x prior to 0.9.5 and 0.8.x prior to 0.8.16 may incorrectly leak credentials during a redirect to a different domain. The root cause is that the client does not properly clear or scope credentials when following a redirect, so credentials sent in the original request are reused in the redirected request to a different domain.

To exploit this vulnerability, the HttpClient must be explicitly configured to follow redirects. An attacker can set up a malicious server that, upon receiving a request with credentials, redirects the client to a different domain under the attacker's control. If the client follows the redirect, it may send the same credentials to the attacker's server, thereby leaking them.

An attacker who successfully exploits this vulnerability can obtain sensitive credentials, such as usernames and passwords, that were intended for a legitimate server. This could lead to unauthorized access, account compromise, or further attacks against the targeted system.

The vulnerability is patched in Reactor Netty versions 0.9.5 and 0.8.16 [1]. Users are advised to upgrade to these versions. As a workaround, administrators can disable redirect following in the HttpClient if not required. No other mitigations are mentioned in the advisory.