CVE-2021-27023

Vulnerability

A flaw exists in Puppet Agent and Puppet Server where HTTP credentials can be leaked when the software follows an HTTP redirect to a different host [1]. This issue is similar to CVE-2018-1000007 [1]. Affected versions include Puppet Agent and Puppet Server prior to the fix; the exact version range is not fully detailed in the available references, but the advisory indicates the vulnerability is present in these components [1][2].

Exploitation

An attacker can exploit this by setting up a malicious server that responds to an HTTP request from Puppet Agent or Puppet Server with a redirect to a different host. The software then follows that redirect and may leak the original credentials (such as those used for HTTP Basic Authentication) to the target host [1]. No further authentication or user interaction beyond making the request is required, though the attacker must be able to intercept or influence the redirect response.

Impact

Successful exploitation results in the disclosure of HTTP credentials to an unintended host [1]. This can lead to unauthorized access to resources that those credentials protect, potentially compromising the confidentiality and integrity of systems managed by Puppet.

Mitigation

Puppet has released updates to address this vulnerability; users should upgrade to fixed versions as specified in the official Puppet security announcements [1][2]. For Fedora, updates were released as part of package updates [4]. If a fix is not yet applied, users should ensure that Puppet components only communicate with trusted servers and avoid following redirects to untrusted hosts. No workaround is explicitly documented in the references.