Executive brief
undici is a Node.js HTTP client library used to make web requests. When following HTTP redirects to different websites, the library fails to clear sensitive cookie headers before sending the request to the new destination. An attacker who can control a redirect target could trick the library into leaking authentication cookies to their server, allowing them to impersonate the victim or access protected resources.
Technical details
The vulnerability is an information disclosure issue in undici's redirect handling mechanism. While the library correctly clears Authorization headers on cross-origin redirects, it fails to clear Cookie headers which are equally sensitive. The attack requires that redirections are enabled (maxRedirections > 0, not the default) and that an attacker can control the redirect destination, such as through an open redirect vulnerability. The impact is leakage of session or authentication cookies to a third-party domain. This was patched in v5.8.0 by implementing proper cookie clearing on cross-host redirects.
Affected products
- Node.js undici before v5.8.0
Timeline
- 2022-07-21: disclosed
- 2022-07-21: patched: patched in v5.8.0