Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:GHSA-WQQ4-5WPV-MX2G
HistoryOct 16, 2023 - 2:05 p.m.

Undici's cookie header not cleared on cross-origin redirect in fetch

2023-10-1614:05:37
Google
osv.dev
12
undici
cookie header
cross-origin redirect
fetch
forbidden request headers
accidental leakage
patches
version 5.26.2

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

0.009 Low

EPSS

Percentile

82.4%

JSON

Impact

Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici’s implementation of fetch.

As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.

CPENameOperatorVersion
undicilt5.26.2

References

Related

osv 6
veracode 2
debiancve 2
cve 2
ubuntucve 2
redhatcve 2
cvelist 2
prion 2
nvd 2
alpinelinux 1
nessus 27
hackerone 1
github 2
ibm 9
cbl_mariner 1
oraclelinux 3
redhat 4
openvas 11
mageia 1
almalinux 3
fedora 6
rocky 1
oracle 1
osv
osv
CVE-2023-45143
2023-10-12 17:15:10
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
2022-07-21 20:31:05
Important: nodejs:18 security update
2023-10-18 00:00:00
veracode
veracode
Open Redirect
2022-07-22 08:40:00
Cross-Origin Cookie Leakage
2023-10-13 04:59:40
debiancve
debiancve
CVE-2022-31151
2022-07-21 04:15:12
CVE-2023-45143
2023-10-12 17:15:10
cve
cve
CVE-2022-31151
2022-07-21 04:15:12
CVE-2023-45143
2023-10-12 17:15:10
ubuntucve
ubuntucve
CVE-2022-31151
2022-07-21 00:00:00
CVE-2023-45143
2023-10-12 00:00:00
redhatcve
redhatcve
CVE-2022-31151
2022-08-25 11:40:39
CVE-2023-45143
2023-10-13 22:52:18
cvelist
cvelist
CVE-2022-31151 Uncleared cookies on cross-host/cross-origin redirect in undici
2022-07-20 23:00:15
CVE-2023-45143 Undici's cookie header not cleared on cross-origin redirect in fetch
2023-10-12 16:35:40
prion
prion
Authorization
2022-07-21 04:15:00
Authorization
2023-10-12 17:15:00
nvd
nvd
CVE-2022-31151
2022-07-21 04:15:12
CVE-2023-45143
2023-10-12 17:15:10
alpinelinux
alpinelinux
CVE-2023-45143
2023-10-12 17:15:10
nessus
nessus
RHEL 9 : node-undici (Unpatched Vulnerability)
2024-05-11 00:00:00
RHEL 8 : node-undici (Unpatched Vulnerability)
2024-05-11 00:00:00
Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-412)
2023-11-04 00:00:00
hackerone
hackerone
Internet Bug Bounty: Cookie headers are not cleared in cross-domain redirect in undici-fetch
2023-11-07 15:47:49
github
github
Undici's cookie header not cleared on cross-origin redirect in fetch
2023-10-16 14:05:37
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
2022-07-21 20:31:05
ibm
ibm
Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote authenticated attacker due to the electron module (CVE-2023-45143)
2024-01-17 16:30:49
Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to a remote authenticated attacker (CVE-2023-45143)
2024-03-08 16:54:11
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple vulnerabilities in Node.js ( CVE-2023-44487, CVE-2023-45143 )
2024-06-21 14:39:01
cbl_mariner
cbl_mariner
CVE-2023-45143 affecting package nodejs18 for versions less than 18.18.2-2
2023-11-08 02:07:28
oraclelinux
oraclelinux
18 security update
2023-10-20 00:00:00
nodejs:18 security update
2023-10-23 00:00:00
nodejs:20 security update
2023-11-22 00:00:00
redhat
redhat
(RHSA-2023:5869) Important: nodejs:18 security update
2023-10-18 22:01:20
(RHSA-2023:5849) Important: nodejs:18 security update
2023-10-18 15:11:16
(RHSA-2023:7205) Important: nodejs:20 security update
2023-11-14 16:23:42
openvas
openvas
Fedora: Security Advisory for nodejs18 (FEDORA-2023-d5030c983c)
2023-10-25 00:00:00
Fedora: Security Advisory for nodejs18 (FEDORA-2023-e9c04d81c1)
2023-10-28 00:00:00
openSUSE: Security Advisory for nodejs18 (SUSE-SU-2023:4207-1)
2024-03-04 00:00:00
mageia
mageia
Updated nodejs packages fix security vulnerabilities
2023-10-23 00:04:51
almalinux
almalinux
Important: nodejs:18 security update
2023-10-18 00:00:00
Important: nodejs:18 security update
2023-10-18 00:00:00
Important: nodejs:20 security update
2023-11-14 00:00:00
fedora
fedora
[SECURITY] Fedora 38 Update: nodejs18-18.18.2-1.fc38
2023-10-24 01:23:42
[SECURITY] Fedora 37 Update: nodejs18-18.18.2-1.fc37
2023-10-26 01:35:04
[SECURITY] Fedora 39 Update: nodejs18-18.18.2-1.fc39
2023-11-03 18:59:17
rocky
rocky
nodejs:20 security update
2023-11-28 22:43:02
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

0.009 Low

EPSS

Percentile

82.4%

JSON
Related for OSV:GHSA-WQQ4-5WPV-MX2G
osv6veracode2debiancve2cve2ubuntucve2redhatcve2cvelist2prion2nvd2alpinelinux1nessus27hackerone1github2ibm9cbl_mariner1oraclelinux3redhat4openvas11mageia1almalinux3fedora6rocky1oracle1