nodejs/undici · Security
Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
- GHSA ID
- GHSA-m4v8-wqvr-p9f7
- CVE ID
- CVE-2024-30260
- Severity
- low
- Published
- Updated
- CVSS
- 3.9 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
- CVSS v3
- 3.9 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Description
Impact
Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().
Patches
This has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75. Fixes has been released in v5.28.4 and v6.11.1.
Workarounds
use fetch() or disable maxRedirections.
References
Linzi Shang reported this.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CWE-285 · Improper Authorization
- CWE-863 · Incorrect Authorization
References
- https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7 ↗
- https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f ↗
- https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75 ↗
- https://hackerone.com/reports/2408074 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-30260 ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33 ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ ↗
- https://lists.fedoraproject.org/archives/list/[email protected]/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E ↗
- https://security.netapp.com/advisory/ntap-20240905-0008 ↗
- https://github.com/advisories/GHSA-m4v8-wqvr-p9f7 ↗