Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-WQQ4-5WPV-MX2G
HistoryOct 16, 2023 - 2:05 p.m.

Undici's cookie header not cleared on cross-origin redirect in fetch

2023-10-1614:05:37
CWE-200
GitHub Advisory Database
github.com
17
undici
cross-origin
redirect
cookie
leakage
patched
version 5.26.2
vulnerability

3.9 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

0.009 Low

EPSS

Percentile

82.4%

JSON

Impact

Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici’s implementation of fetch.

As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.

Affected configurations

Vulners
Node
github_advisory_databaseundiciRange<5.26.2
CPENameOperatorVersion
undicilt5.26.2

References

Related

nessus 27
redhatcve 1
alpinelinux 1
veracode 1
debiancve 1
hackerone 1
cvelist 1
nvd 1
ibm 9
cve 1
ubuntucve 1
cbl_mariner 1
prion 1
osv 7
oraclelinux 3
redhat 3
mageia 1
openvas 11
almalinux 3
fedora 6
rocky 1
oracle 1
nessus
nessus
RHEL 9 : node-undici (Unpatched Vulnerability)
2024-05-11 00:00:00
RHEL 8 : node-undici (Unpatched Vulnerability)
2024-05-11 00:00:00
Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-412)
2023-11-04 00:00:00
redhatcve
redhatcve
CVE-2023-45143
2023-10-13 22:52:18
alpinelinux
alpinelinux
CVE-2023-45143
2023-10-12 17:15:10
veracode
veracode
Cross-Origin Cookie Leakage
2023-10-13 04:59:40
debiancve
debiancve
CVE-2023-45143
2023-10-12 17:15:10
hackerone
hackerone
Internet Bug Bounty: Cookie headers are not cleared in cross-domain redirect in undici-fetch
2023-11-07 15:47:49
cvelist
cvelist
CVE-2023-45143 Undici's cookie header not cleared on cross-origin redirect in fetch
2023-10-12 16:35:40
nvd
nvd
CVE-2023-45143
2023-10-12 17:15:10
ibm
ibm
Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote authenticated attacker due to the electron module (CVE-2023-45143)
2024-01-17 16:30:49
Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to a remote authenticated attacker (CVE-2023-45143)
2024-03-08 16:54:11
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple vulnerabilities in Node.js ( CVE-2023-44487, CVE-2023-45143 )
2024-06-21 14:39:01
cve
cve
CVE-2023-45143
2023-10-12 17:15:10
ubuntucve
ubuntucve
CVE-2023-45143
2023-10-12 00:00:00
cbl_mariner
cbl_mariner
CVE-2023-45143 affecting package nodejs18 for versions less than 18.18.2-2
2023-11-08 02:07:28
prion
prion
Authorization
2023-10-12 17:15:00
osv
osv
CVE-2023-45143
2023-10-12 17:15:10
Undici's cookie header not cleared on cross-origin redirect in fetch
2023-10-16 14:05:37
Important: nodejs:18 security update
2023-10-18 00:00:00
oraclelinux
oraclelinux
18 security update
2023-10-20 00:00:00
nodejs:18 security update
2023-10-23 00:00:00
nodejs:20 security update
2023-11-22 00:00:00
redhat
redhat
(RHSA-2023:5869) Important: nodejs:18 security update
2023-10-18 22:01:20
(RHSA-2023:5849) Important: nodejs:18 security update
2023-10-18 15:11:16
(RHSA-2023:7205) Important: nodejs:20 security update
2023-11-14 16:23:42
mageia
mageia
Updated nodejs packages fix security vulnerabilities
2023-10-23 00:04:51
openvas
openvas
openSUSE: Security Advisory for nodejs18 (SUSE-SU-2023:4207-1)
2024-03-04 00:00:00
Fedora: Security Advisory for nodejs18 (FEDORA-2023-e9c04d81c1)
2023-10-28 00:00:00
Fedora: Security Advisory for nodejs18 (FEDORA-2023-d5030c983c)
2023-10-25 00:00:00
almalinux
almalinux
Important: nodejs:18 security update
2023-10-18 00:00:00
Important: nodejs:18 security update
2023-10-18 00:00:00
Important: nodejs:20 security update
2023-11-14 00:00:00
fedora
fedora
[SECURITY] Fedora 38 Update: nodejs18-18.18.2-1.fc38
2023-10-24 01:23:42
[SECURITY] Fedora 37 Update: nodejs18-18.18.2-1.fc37
2023-10-26 01:35:04
[SECURITY] Fedora 39 Update: nodejs18-18.18.2-1.fc39
2023-11-03 18:59:17
rocky
rocky
nodejs:20 security update
2023-11-28 22:43:02
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00

3.9 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

0.009 Low

EPSS

Percentile

82.4%

JSON
Related for GHSA-WQQ4-5WPV-MX2G
nessus27redhatcve1alpinelinux1veracode1debiancve1hackerone1cvelist1nvd1ibm9cve1ubuntucve1cbl_mariner1prion1osv7oraclelinux3redhat3mageia1openvas11almalinux3fedora6rocky1oracle1