Junglewise Threat Intelligence

CVE-2022-31150: Node.js undici CRLF injection in request headers

CVE-2022-31150 · Severity: low · CVSS 3.1 · Published 2022-07-21

Technologies: undici (npm). Vendors: npm.

Executive brief

Undici, a popular HTTP client for Node.js, is vulnerable to a flaw that allows attackers to inject malicious characters into web requests. This could allow an attacker to manipulate the structure of a request, potentially leading to unauthorized actions or bypassing security controls. Organizations using affected versions should update to version 5.8.0 to ensure the integrity of their web communications.

Technical details

A CRLF (Carriage Return Line Feed) injection vulnerability exists in undici versions prior to 5.8.0. The root cause is the improper neutralization of '\r\n' sequences when processing HTTP request headers, paths, and methods. A remote attacker can exploit this by providing specially crafted input that is subsequently used in an outgoing HTTP request. This allows for the injection of additional headers or the modification of the request structure, which can be used for request splitting or smuggling attacks. The issue is fixed in version 5.8.0; a manual workaround involves sanitizing all untrusted input to remove CRLF sequences.

Affected products

  • Node.js undici < 5.8.0

Timeline

  • 2022-07-18: patched: Version 5.8.0 released with security fixes.
  • 2022-07-18: advisory: GitHub Security Advisory published.
  • 2022-07-21: disclosed: Public disclosure of the vulnerability.

References

Related threats