CVE-2022-27774

What it actually does

The flaw allows credentials supplied for HTTP(S) authentication to be sent in cleartext or reused when a redirect targets a different protocol or port number, bypassing intended isolation.

Why it matters to the business

Stolen credentials can lead to account takeover or lateral movement across services; the issue affects widely reused components with 331 downstream dependents, amplifying exposure across many environments.

How an attack unfolds

An attacker hosts a service on an alternate port or protocol and returns an HTTP redirect from an authenticated request; the vulnerable client follows the redirect and transmits the original credentials, which the attacker captures. Public exploit code exists and the flaw has been known for over four years.

How to fix it

Upgrade affected components to the versions that contain the fix; for pillow (Bitnami) this means version 9.0.0 or later. Disable automatic following of redirects when authentication is in use until patches can be applied.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases, then run integration tests that exercise authenticated redirects to alternate ports and verify credentials are no longer transmitted.

Typical attack path

1. Attacker configures a redirect target on a non-standard port or protocol
2. Victim client initiates authenticated request to initial host
3. Server responds with 3xx redirect to attacker-controlled endpoint
4. Client re-uses credentials when following the redirect
5. Attacker logs the leaked authentication material

How to detect it

Examine web or application logs for authenticated requests that result in redirects to non-standard ports or protocols; correlate with subsequent authentication attempts from the same session to different endpoints.

What your security team should do

• Prioritize upgrade of all instances to the fixed versions within the next change window
• Review and restrict redirect-following behavior in applications that use authentication
• Add monitoring for authentication attempts to unexpected ports or protocols
• Re-issue credentials that may have been exposed through prior redirects