Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
kiota-java
Vendor
microsoft
Product
kiota-java
Platforms
Unknown
Default status
Unknown
kiota-java · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 1.9.1
affected
Unavailable
Unavailable
Unavailable
None listed
Microsoft.Kiota.Abstractions
Vendor
microsoft
Product
Microsoft.Kiota.Abstractions
Platforms
Unknown
Default status
Unknown
Microsoft.Kiota.Abstractions · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 1.22.0
affected
Unavailable
Unavailable
Unavailable
None listed
github.com/microsoft/kiota-http-go
Vendor
microsoft
Product
github.com/microsoft/kiota-http-go
Platforms
Unknown
Default status
Unknown
github.com/microsoft/kiota-http-go · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 1.5.5
affected
Unavailable
Unavailable
Unavailable
None listed
kiota-typescript
Vendor
microsoft
Product
kiota-typescript
Platforms
Unknown
Default status
Unknown
kiota-typescript · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 1.0.0-preview.100
affected
Unavailable
Unavailable
Unavailable
None listed
microsoft-kiota-abstractions
Vendor
microsoft
Product
microsoft-kiota-abstractions
Platforms
Unknown
Default status
Unknown
microsoft-kiota-abstractions · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 1.9.1
affected
Unavailable
Unavailable
Unavailable
None listed
microsoft-kiota-http
Vendor
microsoft
Product
microsoft-kiota-http
Platforms
Unknown
Default status
Unknown
microsoft-kiota-http · Scoped product and version facts