Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-31033

CVE-2022-31033: Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect

5.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-31033
GHSA ID
GHSA-64qm-hrgp-pgr9
EPSS Score
0.62468%
CWE
CWE-200
Published
6/9/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
mechanizerubygems< 2.8.52.8.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper credential handling during redirects. The commit diff shows critical changes in the response_redirect method where:

  1. Credential headers were split into separate constants (Authorization vs Cookies)
  2. Logic was added to clear Authorization headers specifically when port changes
  3. Test cases were added to verify Authorization header removal on port redirect

This indicates the original response_redirect implementation didn't properly handle port-based redirect credential isolation, specifically for Authorization headers, while correctly preserving cookies per RFC 6265.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**Summ*ry** M****niz* (ru*y**m) `< v*.*.*` l**ks t** `*ut*oriz*tion` *****r **t*r * r**ir**t to * *i***r*nt port on t** s*m* sit*. **Miti**tion** Up*r*** to M****niz* v*.*.* or l*t*r. **Not*s** S** [*ttps://*url.s*/*o*s/*V*-****-*****.*tml](*V*-

Reasoning

T** vuln*r**ility st*ms *rom improp*r *r***nti*l **n*lin* *urin* r**ir**ts. T** *ommit *i** s*ows *riti**l ***n**s in t** r*spons*_r**ir**t m*t*o* w**r*: *. *r***nti*l *****rs w*r* split into s*p*r*t* *onst*nts (*ut*oriz*tion vs *ooki*s) *. Lo*i* w*s