nodejs undici up to 5.28.3/6.11.0 HTTP Header fetch Proxy-Authorization improper authorization

Summaryinfo

A vulnerability was found in nodejs undici up to 5.28.3/6.11.0. It has been rated as critical. This affects the function fetch of the component HTTP Header Handler. Performing a manipulation of the argument Proxy-Authorization results in improper authorization. This vulnerability is identified as CVE-2024-30260. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in nodejs undici up to 5.28.3/6.11.0. This affects the function fetch of the component HTTP Header Handler. The manipulation of the argument Proxy-Authorization with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-30260 since 03/26/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation needs additional levels of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 5.28.4 or 6.11.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• nodejs

Name

• undici

Version

• 5.28.0
• 5.28.1
• 5.28.2
• 5.28.3
• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11.0

License

• open-source

Website

• Product: https://github.com/nodejs/undici/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion