[BUG] ResponseException message leaks Authorization HTTP header

[gweyeratlassian]

What is the bug?

The ResponseException constructor deserializes the response body and includes it in the exception message. If the response body contains secrets such as credentials, these might end up being logged as it's common to log exception messages.

How can one reproduce the bug?

1. Provision an OpenSearch Domain without fine-grained access control (and hence without internal user database)
2. Configure the Java OpenSearch client to use basic authentication
3. Call the cluster health endpoint (/_cluster/health)

The call will fail with a 403 HTTP status code. An ResponseException will be thrown with the below message:

Don't worry about the base64 credentials, I used 'master:master'

method [GET], host [https://[redacted].ap-southeast-2.es.amazonaws.com], URI [/_cluster/health], status line [HTTP/2.0 403 Forbidden]
{"message":"Authorization header requires 'Credential' parameter. Authorization header requires 'Signature' parameter. Authorization header requires 'SignedHeaders' parameter. Authorization header requires existence of either a 'X-Amz-Date' or a 'Date' header. Authorization=Basic bWFzdGVyOm1hc3Rlcg=="}

You can reproduce using curl:

curl --location 'https://[redacted].ap-southeast-2.es.amazonaws.com/_cluster/health' --header 'Authorization: Basic bWFzdGVyOm1hc3Rlcg=='

Response:

{
    "message": "Authorization header requires 'Credential' parameter. Authorization header requires 'Signature' parameter. Authorization header requires 'SignedHeaders' parameter. Authorization header requires existence of either a 'X-Amz-Date' or a 'Date' header. Authorization=Basic bWFzdGVyOm1hc3Rlcg=="
}

What is the expected behavior?

First, I don't think AWS OpenSearch should return the value of an Authorization header in a body response. In this instance, it could specify that Basic was used but not the credentials.

The SDK could also be modified to not include the response body when the status code is 401 or 403.

What is your host/environment?

• opensearch-java 2.14.0
• AWS OpenSearch 2.11 without fine-grained access control

Do you have any screenshots?

If applicable, add screenshots to help explain your problem.

Do you have any additional context?

Add any other context about the problem.

[dblock]

Looks like this is a potential AWS service issue and not a client issue, will close it here and forward to AWS security/support. Generally please don't report anything that looks like a security issue on GitHub, however minor, email security@opensearch.org.