[Security] Authorization Header Leak on Cross-Origin 307/308 Redirects

Summary

superagent leaks Authorization headers to attacker-controlled servers when following cross-origin 307/308 redirects. The existing credential-stripping logic only applies to 301/302/303 redirects.

Details

In lib/node/index.js, the _redirect() method calls cleanHeader() for 301/302/303 (strips auth on cross-origin) but for 307/308 only deletes host header. Auth headers leak.

PoC

1. Legitimate server returns 307 to evil.com
2. Client sends request with Authorization header
3. evil.com receives the full Authorization header

Impact

• Credential theft via 307/308 redirects
• ~5M weekly npm downloads
• CVSS 6.5, CWE-522

Fix

Call cleanHeader() in the 307/308 path when origin changes.

References: CVE-2023-45143 (undici), CVE-2023-46136 (got)