undici up to 5.8.0 on Node.js undici.request path/pathname server-side request forgery

Summaryinfo

A vulnerability was found in undici up to 5.8.0 on Node.js. It has been declared as critical. Affected by this issue is the function undici.request. The manipulation of the argument path/pathname results in server-side request forgery. This vulnerability is cataloged as CVE-2022-35949. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in undici up to 5.8.0 on Node.js (JavaScript Library). It has been classified as critical. Affected is the function undici.request. The manipulation of the argument path/pathname with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `[email protected]`. The best workaround is to validate user input before passing it to the `undici.request` call.

The weakness was shared 08/13/2022 as GHSA-8qr4-xgw6-wmr3. The advisory is available at github.com. This vulnerability is traded as CVE-2022-35949 since 07/15/2022. Technical details are known, but there is no available exploit.

Upgrading to version 5.8.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 124f7ebf705366b2e1844dff721928d270f87895 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• JavaScript Library

Name

• undici

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion