Executive brief
undici is a Node.js HTTP client library used by developers to make web requests. A flaw in how it processes user-supplied path parameters allows attackers to redirect requests to unintended servers, potentially exposing sensitive data from internal systems or enabling further attacks. An attacker can craft a malicious pathname that causes the library to bypass the intended destination and send requests to arbitrary hosts.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the undici HTTP client library's pathname parameter handling (CWE-918). When an application passes user-controlled input to the pathname option of undici.request(), the library fails to properly validate that the pathname is relative and allows absolute URLs or protocol-relative URLs (e.g., "//127.0.0.1") to override the origin parameter. An attacker can inject a URL like "//127.0.0.1" or "http://127.0.0.1" into the pathname, causing requests to be sent to an attacker-controlled destination instead of the intended origin, even when the origin is correctly specified by the application. The vulnerability requires no authentication or user interaction and is remotely exploitable. The issue was fixed in undici version 5.8.2.
Affected products
- Node.js undici <= 5.8.1
Timeline
- 2022-08-09: disclosed
- 2022-08-18: patched: Fixed in version 5.8.2