CVE-2022-32210

2022-07-1400:00:00

ubuntu.com

undici.proxyagent

certificate verification

https traffic

mitm attack

unix

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

0.001

Percentile

46.4%

JSON

Undici.ProxyAgent never verifies the remote server’s certificate, and
always exposes all request & response data to the proxy. This unexpectedly
means that proxies can MitM all HTTPS traffic, and if the proxy’s URL is
HTTP then it also means that nominally HTTPS requests are actually sent via
plain-text HTTP between Undici and the proxy server.