CVE-2022-31151

low-risk
Published 2022-07-21

Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default).

Do I need to act?

-
0.12% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10 Low
NETWORK / HIGH complexity

Affected Products (1)

Undici

Affected Vendors

Nodejs

References (8)

Exploit https://github.com/nodejs/undici/issues/872
Third Party Advisory https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp
Permissions Required https://hackerone.com/reports/1635514
Third Party Advisory https://security.netapp.com/advisory/ntap-20220909-0006/
Exploit https://github.com/nodejs/undici/issues/872
Third Party Advisory https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp
Permissions Required https://hackerone.com/reports/1635514
Third Party Advisory https://security.netapp.com/advisory/ntap-20220909-0006/
19
/ 100
low-risk
Severity 13/34 · Low
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal