CVE-2022-31151 — Open Redirect in Nodejs Undici

Vendor	Product	Version range	Fixed in
debian	node-undici	< node-undici 5.8.0+dfsg1+~cs18.9.16-1 (bookworm)	node-undici 5.8.0+dfsg1+~cs18.9.16-1 (bookworm)
nodejs	undici	< 5.7.1	5.7.1
nodejs	undici	>= 0 < 5.8.0	5.8.0

OSV

undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect

osv·2022-07-21·CVSS 9.8

CVE-2022-31151 [CRITICAL] undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect ### Impact Authorization headers are already cleared on cross-origin redirect in https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189, based on https://github.com/nodejs/undici/issues/872. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There also has been active discussion of implementing a cookie store https://github.com/nodejs/undici/pull/1441, which suggests that there are active users using cookie headers in undici. As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd part

GHSA

undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect

ghsa·2022-07-21·CVSS 9.8

CVE-2022-31151 [CRITICAL] CWE-346 undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect ### Impact Authorization headers are already cleared on cross-origin redirect in https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189, based on https://github.com/nodejs/undici/issues/872. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There also has been active discussion of implementing a cookie store https://github.com/nodejs/undici/pull/1441, which suggests that there are active users using cookie headers in undici. As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd part

OSV

CVE-2022-31151: Authorization headers are cleared on cross-origin redirect

osv·2022-07-21·CVSS 6.5

CVE-2022-31151 [MEDIUM] CVE-2022-31151: Authorization headers are cleared on cross-origin redirect Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default).

Red Hat

nodejs/undici: Cookie headers uncleared on cross-origin redirect

vendor_redhat·2022-07-21·CVSS 3.7

CVE-2022-31151 [LOW] CWE-200 nodejs/undici: Cookie headers uncleared on cross-origin redirect nodejs/undici: Cookie headers uncleared on cross-origin redirect Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default). A flaw was found in the undici package. After cookie headers are set, they are not cleared. This issue could allow an attacker to take advantage of this cookie,

Debian

CVE-2022-31151: node-undici - Authorization headers are cleared on cross-origin redirect. However, cookie head...

vendor_debian·2022·CVSS 3.7

CVE-2022-31151 [LOW] CVE-2022-31151: node-undici - Authorization headers are cleared on cross-origin redirect. However, cookie head... Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default). Scope: local bookworm: resolved (fixed in 5.8.0+dfsg1+~cs18.9.16-1) forky: resolved (fixed in 5.8.0+dfsg1+~cs18.9.16-1) sid: resolved (fixed in 5.8.0+dfsg1+~cs18.9.16-1) trixie: resolved (fixed in 5.8.0+dfsg1+~cs18.9.16-1)

CVE-2022-31151: Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec…

Affected

CVSS provenance