PT-2022-20566 · Undici · Undici
Haxatron
·
Published
2022-07-20
·
Updated
2023-10-16
·
CVE-2022-31151
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
undici versions prior to 5.7.1
Description
The issue arises when authorization headers are cleared on cross-origin redirects, but cookie headers remain uncleared. This may lead to accidental leakage of cookies to a 3rd-party site or a malicious attacker who can control the redirection target. By design,
cookie headers are forbidden request headers, but undici handles headers more liberally than the specification. There are active users using cookie headers in undici, which increases the risk of exploitation. The vulnerability is not exploitable by default if redirections are not enabled, i.e., maxRedirections: 0.Recommendations
For versions prior to 5.7.1, update to version 5.7.1 or later to resolve the issue. As a temporary workaround, consider disabling redirections by setting
maxRedirections: 0 to minimize the risk of exploitation. Avoid using cookie headers in undici until the issue is resolved.Exploit
Fix
Open Redirect
Information Disclosure
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undici