CVE-2022-35949
published 2022-08-12CVE-2022-35949: undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user…
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.39%
69.0th percentile
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `[email protected]`. The best workaround is to validate user input before passing it to the `undici.request` call.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-undici | < node-undici 5.8.2+dfsg1+~cs18.9.18.1-1 (bookworm) | node-undici 5.8.2+dfsg1+~cs18.9.18.1-1 (bookworm) |
| nodejs | undici | <= 5.8.1 | — |
| nodejs | undici | >= 0 < 5.8.2 | 5.8.2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
`undici.request` vulnerable to SSRF using absolute URL on `pathname`
osv·2022-08-18
CVE-2022-35949 [MEDIUM] `undici.request` vulnerable to SSRF using absolute URL on `pathname`
`undici.request` vulnerable to SSRF using absolute URL on `pathname`
### Impact
`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`.
If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1`
```js
const undici = require("undici")
undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})
```
Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`.
If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that th
GHSA
`undici.request` vulnerable to SSRF using absolute URL on `pathname`
ghsa·2022-08-18
CVE-2022-35949 [MEDIUM] CWE-918 `undici.request` vulnerable to SSRF using absolute URL on `pathname`
`undici.request` vulnerable to SSRF using absolute URL on `pathname`
### Impact
`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`.
If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1`
```js
const undici = require("undici")
undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})
```
Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`.
If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that th
OSV
CVE-2022-35949: undici is an HTTP/1
osv·2022-08-12·CVSS 9.8
CVE-2022-35949 [CRITICAL] CVE-2022-35949: undici is an HTTP/1
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot chang
Red Hat
nodejs: undici.request vulnerable to SSRF
vendor_redhat·2022-08-09·CVSS 5.3
CVE-2022-35949 [MEDIUM] CWE-918 nodejs: undici.request vulnerable to SSRF
nodejs: undici.request vulnerable to SSRF
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they
Debian
CVE-2022-35949: node-undici - undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulne...
vendor_debian·2022·CVSS 5.3
CVE-2022-35949 [MEDIUM] CVE-2022-35949: node-undici - undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulne...
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot chang
No detection rules found.
No public exploits indexed.
https://github.com/nodejs/undici/commit/124f7ebf705366b2e1844dff721928d270f87895https://github.com/nodejs/undici/releases/tag/v5.8.2https://github.com/nodejs/undici/security/advisories/GHSA-8qr4-xgw6-wmr3https://github.com/nodejs/undici/commit/124f7ebf705366b2e1844dff721928d270f87895https://github.com/nodejs/undici/releases/tag/v5.8.2https://github.com/nodejs/undici/security/advisories/GHSA-8qr4-xgw6-wmr3
2022-08-12
Published