CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici

2024-02-1621:40:37

CWE-200

GitHub_M

github.com

undici

http/1.1

proxy-authorization

vulnerability

patched

upgrade

CVSS3

3.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

AI Score

4.6

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authentication headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CNA Affected

[
  {
    "vendor": "nodejs",
    "product": "undici",
    "versions": [
      {
        "status": "affected",
        "version": "< 5.28.3"
      },
      {
        "status": "affected",
        "version": ">= 6.0.0, < 6.6.1"
      }
    ]
  }
]