CVE-2024-38372 Undici vulnerable to data leak when using response.arrayBuffer()

2024-07-0820:25:59

CWE-201

GitHub_M

github.com

undici

http/1.1

data leak

arraybuffer

node.js

vulnerability

patch

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

Low

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a fetch() request, response.arrayBuffer() might include portion of memory from the Node.js process. This has been patched in v6.19.2.

CNA Affected

[
  {
    "vendor": "nodejs",
    "product": "undici",
    "versions": [
      {
        "status": "affected",
        "version": ">= 6.14.0, < 6.19.2"
      }
    ]
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:nodejs:undici:6.14.0:*:*:*:*:*:*:*"
    ],
    "vendor": "nodejs",
    "product": "undici",
    "versions": [
      {
        "status": "affected",
        "version": "6.14.0",
        "lessThan": "6.19.2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]