PT-2022-23052 · Npm+1 · Undici+1
Haxatron
+1
·
Published
2022-08-12
·
Updated
2024-06-15
·
CVE-2022-35949
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
undici versions prior to 5.8.1
Description
The issue is related to Server-side Request Forgery (SSRF) when an application takes in user input into the
path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1, it can result in an SSRF as the hostname can change because the specified path parameter is combined with the base URL. For example, using the undici.request call with origin set to "http://example.com" and pathname set to "//127.0.0.1" will process the request as http://127.0.0.1/ and send it to http://127.0.0.1. The path parameter of undici.request is vulnerable when user input is passed into it.Recommendations
To resolve the issue, update to
undici@5.8.1 or later. As a temporary workaround, validate user input before passing it to the undici.request call to prevent SSRF attacks.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Undici