Header Forgery in http-signature
Affected versions of `http-signature` contain a vulnerability which can allow an attacker in a privileged network position to modify header names and change the meaning of the request, without requiring an updated signature.This problem occurs because vulnerable versions of `http-signature` sign the contents of headers, but not the header names.Proof of ConceptConsider this to be the initial, untampered request:And the request is intercepted and tampered as follows:In the resulting responses, both requests would pass signature verification without issue.RecommendationUpdate to version 0.10.0 or higher.