PT-2024-2956 · Node.Js+3 · Undici+3

Uzlopak · Published 2024-04-04 · Updated 2024-12-18 · CVE-2024-30261

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Undici versions prior to 5.28.4 Undici versions prior to 6.11.1

Description The issue is related to insufficient access control in the Undici HTTP/1.1 client for Node.js, allowing a remote attacker to execute arbitrary code by altering the integrity option passed to fetch(). This enables fetch() to accept tampered requests as valid.

Recommendations For versions prior to 5.28.4, update to version 5.28.4 or later. For versions prior to 6.11.1, update to version 6.11.1 or later. As a temporary workaround, ensure that the integrity option cannot be tampered with to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

AZL-39773

AZL-39819

BDU:2024-03123

CVE-2024-30261

GHSA-9QXR-QJ54-H672

OESA-2024-2174

OPENSUSE-SU-2024:13855-1

OPENSUSE-SU-2024_1301-1

OPENSUSE-SU-2024_1309-1

OPENSUSE-SU-2024_1837-1

SUSE-SU-2024:1301-1

SUSE-SU-2024:1307-1

SUSE-SU-2024:1309-1

SUSE-SU-2024:1836-1

SUSE-SU-2024:1837-1

Affected Products

Astra Linux

Debian

Suse

Undici

References · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30261.json · Exploit
• 🔥 https://hackerone.com/reports/2377760 · Exploit
• https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055 · Patch
• https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672 · Vendor Advisory
• https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3 · Patch
• https://osv.dev/vulnerability/CVE-2024-30261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30261 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-30261 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-30261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27983 · Security Note
• https://osv.dev/vulnerability/AZL-39819 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1309-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-30261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30260 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33 · Vendor Advisory