CVE-2011-0160 in iOS
Summary
by MITRE
WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle redirects in conjunction with HTTP Basic Authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/30/2025
The vulnerability identified as CVE-2011-0160 represents a critical security flaw in WebKit-based browsers that affected Apple Safari versions prior to 5.0.4 and iOS versions before 4.3. This issue stems from improper handling of HTTP redirects when Basic Authentication is involved, creating a significant vector for credential interception attacks. The flaw operates at the intersection of web browser security mechanisms and HTTP protocol handling, specifically targeting the way browsers process authentication headers during redirect scenarios.
The technical implementation of this vulnerability involves WebKit's failure to properly sanitize or validate HTTP headers when processing redirects that contain authentication information. When a web server responds with a redirect that includes an Authorization header, the browser should ideally strip or properly handle this sensitive information to prevent exposure to unintended parties. However, the vulnerable WebKit implementation failed to adequately process these headers during redirect operations, allowing malicious servers to capture authentication credentials through log files or network monitoring tools.
From an operational perspective, this vulnerability creates a dangerous attack surface where remote web servers can actively capture user credentials simply by configuring their servers to redirect requests in specific ways. Attackers can craft malicious web pages that initiate redirects to servers they control, potentially logging the Authorization headers that contain username and password information. The impact extends beyond simple credential theft to include potential session hijacking and unauthorized access to protected resources, as the captured credentials can be used to impersonate legitimate users within the affected applications and services.
The vulnerability aligns with CWE-200, which addresses information exposure through improper handling of sensitive data, and relates to ATT&CK technique T1566, which covers credential access through phishing and social engineering. Organizations using affected versions of Safari or iOS were particularly vulnerable because the flaw occurred at the browser level rather than requiring user interaction beyond visiting a malicious website. This makes the vulnerability especially dangerous in enterprise environments where users may encounter malicious content in email attachments, web browsing sessions, or compromised websites.
Mitigation strategies for this vulnerability included immediate updates to Safari and iOS to versions 5.0.4 and 4.3 respectively, which implemented proper header handling during redirect operations. Additionally, network administrators should have implemented strict monitoring of HTTP traffic for suspicious redirect patterns and deployed web application firewalls to detect and block malicious redirect attempts. Security awareness training became crucial for users to recognize potentially malicious redirects, while organizations should have reviewed their authentication practices to minimize the impact of credential exposure. The vulnerability highlighted the importance of proper HTTP header management in browser security implementations and demonstrated how seemingly minor protocol handling issues can create significant security risks in real-world deployment scenarios.