CVE-2022-31150: CRLF injection in request headers in undici

Background

Undici is an HTTP/1.1 client library for Node.js. It provides a high-performance, low-memory footprint alternative to the built-in http module. Undici is widely used for making HTTP requests in Node.js applications. However, versions prior to v5.8.0 are vulnerable to CRLF injection in request headers. This vulnerability allows an attacker to inject CRLF sequences into request headers, potentially leading to various security issues.

Vulnerability Detail

The vulnerability in undici allows an attacker to inject CRLF sequences into request headers. This can be exploited by crafting malicious headers that include CRLF sequences, which can lead to various security issues such as HTTP response splitting, cache poisoning, and cross-site scripting (XSS) attacks. An example of a vulnerable code snippet is as follows:

const undici = require('undici')

const response = undici.request("http://127.0.0.1:1000", {
  headers: {'a': "\r\nb"}
})

To mitigate this vulnerability, it is recommended to update undici to v5.8.0 or later.

npm install undici@8.12.3

npm install undici@5.8.0

Workaround

If updating undici is not immediately feasible, a workaround is to sanitize all HTTP headers from untrusted sources to eliminate CRLF sequences. This can be done by removing any occurrences of \r\n in the headers before passing them to undici. Here's an example of how to sanitize headers:

const sanitizeHeaders = (headers) => {
  for (const key in headers) {
    if (typeof headers[key] === 'string') {
      headers[key] = headers[key].replace(/\r\n/g, '');
    }
  }
};

const undici = require('undici');

const headers = {'a': "\r\nb"};

sanitizeHeaders(headers);

const response = undici.request("http://127.0.0.1:1000", {
  headers
});

Conclusion

Undici versions prior to v5.8.0 are vulnerable to CRLF injection in request headers. This vulnerability can be exploited to perform various attacks, including HTTP response splitting, cache poisoning, and cross-site scripting (XSS) attacks. To mitigate the vulnerability, it is recommended to update undici to v5.8.0 or later. If updating is not immediately feasible, sanitize all HTTP headers from untrusted sources to eliminate CRLF sequences. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for undici →

FAQ