nodejs/undici · Security
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
- GHSA ID
- GHSA-9qxr-qj54-h672
- CVE ID
- CVE-2024-30261
- Severity
- low
- Published
- Updated
- CVSS
- 2.6 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
- CVSS v3
- 2.6 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Description
Impact
If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.
Patches
Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3. Fixes has been released in v5.28.4 and v6.11.1.
Workarounds
Ensure that integrity cannot be tampered with.
References
CWEs
- CWE-284 · Improper Access Control
References
- https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672 ↗
- https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055 ↗
- https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3 ↗
- https://hackerone.com/reports/2377760 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-30261 ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33 ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ ↗
- https://security.netapp.com/advisory/ntap-20240905-0008 ↗
- https://github.com/advisories/GHSA-9qxr-qj54-h672 ↗