PT-2022-3494 · Node.Js · Undici

Pimterry · Published 2022-06-17 · Updated 2022-07-25 · CVE-2022-32210

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Undici versions prior to 5.5.1

Description The issue is related to errors in the certificate authentication procedure of the Undici module in Node.js, which can allow a remote attacker to access protected information. Specifically, Undici.ProxyAgent never verifies the remote server's certificate and exposes all request and response data to the proxy. This means that proxies can perform man-in-the-middle (MitM) attacks on all HTTPS traffic. If the proxy's URL is HTTP, then nominally HTTPS requests are sent via plain-text HTTP between Undici and the proxy server.

Recommendations For versions prior to 5.5.1, update to version 5.5.1 or later to resolve the issue. As a temporary workaround, consider not using ProxyAgent as a dispatcher for TLS connections until a patch is applied.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2022-04275

CVE-2022-32210

GHSA-PGW7-WX7W-2W33

Affected Products

Undici

References · 11

• 🔥 https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33 · Exploit
• 🔥 https://hackerone.com/reports/1583680 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-32210 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pgw7-wx7w-2w33 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04275 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-32210 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-32210 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32210 · Vendor Advisory
• https://github.com/nodejs/undici · Note
• https://ibm.com/support/pages/node/6601261 · Note
• https://t.me/cibsecurity/46246 · Telegram Post