PT-2024-2689 · Node.Js+4 · Undici+4

T1M0N0 · Published 2024-02-05 · Updated 2025-08-12 · CVE-2024-24758

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Undici versions prior to 5.28.3 Undici versions prior to 6.6.1

Description The issue is related to insufficient protection of service data due to incorrect clearing of Proxy-Authentication headers in the Undici HTTP/1.1 client for Node.js. This could allow a remote attacker to elevate their privileges. The Proxy-Authentication headers were not cleared on cross-origin redirects, unlike the Authorization headers which were already being cleared. There are no known workarounds for this issue.

Recommendations For versions prior to 5.28.3, upgrade to version 5.28.3 or later. For versions prior to 6.6.1, upgrade to version 6.6.1 or later. As a temporary workaround, consider disabling the use of Proxy-Authentication headers in the Undici client until a patch is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-942

Related Identifiers

ALT-PU-2025-2007

ALT-PU-2025-2047

AZL-35045

BDU:2024-02800

CVE-2024-24758

GHSA-3787-6PRV-H9W3

OPENSUSE-SU-2024:13697-1

OPENSUSE-SU-2024:13698-1

OPENSUSE-SU-2024_0728-1

OPENSUSE-SU-2024_0729-1

SUSE-SU-2024:0643-1

SUSE-SU-2024:0644-1

SUSE-SU-2024:0728-1

SUSE-SU-2024:0729-1

SUSE-SU-2024:0730-1

SUSE-SU-2024:0731-1

Affected Products

Alt Linux

Astra Linux

Debian

Suse

Undici

References · 67

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24758.json · Exploit
• https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef · Patch
• https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-24758 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0643-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24758 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13698-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02800 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2024-24758 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0411SE18 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24758 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24758 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-24758 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0728-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-24758 · Vendor Advisory