cordova-plugin-advanced-http through 3.3.1 Cookie Leak via Cross-Origin Redirects

Summary

cordova-plugin-advanced-http through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts by forwarding an explicitly set Cookie header across cross-origin redirects. Attackers controlling a redirect target, via an open redirect or attacker-supplied URL, can receive the original host's session cookies and hijack user sessions.

Remediation

1. Inventory every silkimen cordova-plugin-advanced-http deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/silkimen/cordova-plugin-advanced-http/pull/549
• Patchhttps://github.com/silkimen/cordova-plugin-advanced-http/commit/777a6f10939fd76ddf7f9fe029ae3fcaed850ca1
• Advisoryhttps://www.vulncheck.com/advisories/cordova-plugin-advanced-http-through-3.3.1-cookie-leak-via-cross-origin-redirects
• Referencehttps://github.com/silkimen/cordova-plugin-advanced-http
• Referencehttps://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/www/helpers.js#L376
• Referencehttps://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/src/ios/CordovaHttpPlugin.m#L88-L98