GoogleOSV:GHSA-9QXR-QJ54-H672Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
2.6 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
6.8 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
10.4%
Impact
If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.
Patches
Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3.
Fixes has been released in v5.28.4 and v6.11.1.
Workarounds
Ensure that integrity cannot be tampered with.
References
References
github.com/nodejs/undici
github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055
github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3
github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672
hackerone.com/reports/2377760
lists.fedoraproject.org/archives/list/[email protected]/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33
lists.fedoraproject.org/archives/list/[email protected]/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ
lists.fedoraproject.org/archives/list/[email protected]/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E
nvd.nist.gov/vuln/detail/CVE-2024-30261
Related
2.6 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
6.8 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
10.4%