CVE-2022-32210
published 2022-07-14CVE-2022-32210: `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that…
PriorityP434medium6.5CVSS 3.1
AVNACHPRNUINSUCHILAN
EPSS
0.44%
35.5th percentile
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-undici | < node-undici 5.6.1+dfsg1+~cs18.9.16-1 (bookworm) | node-undici 5.6.1+dfsg1+~cs18.9.16-1 (bookworm) |
| https | github.com_nodejs_undici | — | — |
| nodejs | undici | >= 4.8.2 < 5.5.1 | 5.5.1 |
| nodejs | undici | >= 4.8.2 < 5.5.1 | 5.5.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-32210: `Undici
osv·2022-07-14·CVSS 6.5
CVE-2022-32210 [MEDIUM] CVE-2022-32210: `Undici
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
GHSA
ProxyAgent vulnerable to MITM
ghsa·2022-06-17
CVE-2022-32210 [HIGH] CWE-295 ProxyAgent vulnerable to MITM
ProxyAgent vulnerable to MITM
### Description
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
### Impact
This affects all use of HTTPS via HTTP proxy using **`Undici.ProxyAgent`** with Undici or Node's global `fetch`. In this case, it removes all HTTPS security from all requests sent using Undici's `ProxyAgent`, allowing trivial MitM attacks by anybody on the network path between the client and the target server (local network users, your ISP, the proxy, the target server's ISP, etc).
This
OSV
ProxyAgent vulnerable to MITM
osv·2022-06-17
CVE-2022-32210 [HIGH] ProxyAgent vulnerable to MITM
ProxyAgent vulnerable to MITM
### Description
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
### Impact
This affects all use of HTTPS via HTTP proxy using **`Undici.ProxyAgent`** with Undici or Node's global `fetch`. In this case, it removes all HTTPS security from all requests sent using Undici's `ProxyAgent`, allowing trivial MitM attacks by anybody on the network path between the client and the target server (local network users, your ISP, the proxy, the target server's ISP, etc).
This
Debian
CVE-2022-32210: node-undici - `Undici.ProxyAgent` never verifies the remote server's certificate, and always e...
vendor_debian·2022·CVSS 6.5
CVE-2022-32210 [MEDIUM] CVE-2022-32210: node-undici - `Undici.ProxyAgent` never verifies the remote server's certificate, and always e...
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
Scope: local
bookworm: resolved (fixed in 5.6.1+dfsg1+~cs18.9.16-1)
forky: resolved (fixed in 5.6.1+dfsg1+~cs18.9.16-1)
sid: resolved (fixed in 5.6.1+dfsg1+~cs18.9.16-1)
trixie: resolved (fixed in 5.6.1+dfsg1+~cs18.9.16-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-07-14
Published