CVE-2022-31151: node-undici Cross-Origin Redirect Cookie Leakage Vulnerability
Summary
CVE-2022-31151: Authorization headers are cleared on cross-origin redirect. Affects node-undici versions < 5.8.0+dfsg1+~cs18.9.16-1. Fixed in 5.8.0+dfsg1+~cs18.9.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
node-undici is a popular HTTP/1.1 client designed for Node.js, known for its performance and lightweight design. It provides a modern API for making HTTP requests and is widely used in various applications. However, it has a vulnerability that affects how it handles authorization and cookie headers during cross-origin redirects, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from the fact that while authorization headers are cleared during cross-origin redirects, cookie headers, which can contain sensitive information, remain uncleared. This oversight can lead to accidental leakage of cookies to third-party sites or malicious actors who can manipulate the redirection target. The vulnerability was introduced in earlier versions of node-undici and has been addressed in version 5.7.1. By default, this vulnerability is not exploitable unless redirections are enabled.
How To Fix
Minimum fixed version
5.8.0+dfsg1+~cs18.9.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-undiciTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable redirections by setting the 'maxRedirections' option to 0 in your requests. Here is an example of how to implement this in your code:
const { request } = require('undici');
request('https://example.com', { maxRedirections: 0 });
Conclusion
CVE-2022-31151 is a significant vulnerability in the node-undici package that can lead to the leakage of sensitive cookie information during cross-origin redirects. It is crucial to update to the latest version to mitigate this risk and to consider disabling redirections as a temporary measure.
See every vulnerability recorded for node-undici →
FAQ
CVE-2022-31151 is a vulnerability in the node-undici package that allows for the potential leakage of cookie headers during cross-origin redirects.
If your application uses node-undici and allows cross-origin redirects, sensitive cookie information could be unintentionally sent to third-party sites, posing a security risk.
Versions prior to 5.8.0+dfsg1+~cs18.9.16-1 are affected by this vulnerability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground.
The CVSS score for CVE-2022-31151 is 6.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for node-undici.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
