Repository navigation
CalDAV client re-sends Basic auth to redirect targets (credential theft on 302) #105
Description
What
internal/caldav/webdav.go:17-43 (do()) sets Basic auth unconditionally, and propfind (webdav.go:47-75) follows up to 6 redirects re-sending it. A malicious or later-compromised CalDAV server can answer 302 to an attacker host and harvest the victim's app-specific password.
Severity
Low-medium. The common case is self-theft (the user typed the URL themselves). The bad case is a legitimate server compromised later, turning stored reconnect behavior into credential theft. Auth failures also re-dial on every conflict check, so the exposure persists past connect.
Fix
Only attach auth when the redirect target shares host (and scheme) with the original request.
Found by the 0.10.1 pre-release audit (Layer 2, SSRF pass).
Activity
pullfrog commentedon Sep 29, 2026
fix(caldav): withhold Basic auth on cross-origin redirects (#105)
chore(audit): re-verify claims manifest after 0.10.x changes
shockalotti commentedon Sep 29, 2026
Fixed on main. The redirect follower re-sent Basic auth to any host a 302 pointed at; credentials now stay on the original scheme+host and are stripped anywhere else. Covered by a two-server test that fails on the old code (leaked Authorization header) and passes on the new.