Executive brief
Undici is Node.js's HTTP/1.1 client library used in network communications. The library failed to sanitize the host HTTP header, allowing attackers to inject carriage return and line feed (CRLF) characters. An authenticated attacker with user interaction could leverage this to manipulate HTTP headers and potentially bypass security controls or inject malicious content into requests.
Technical details
The vulnerability is a CRLF injection flaw (CWE-93) in the undici HTTP client library. The root cause is insufficient input validation/sanitization of the host header parameter before it is used in HTTP request construction. An attacker can inject CRLF sequences (\r\n) into the host header value to break out of the header context and inject additional headers or content. The attack requires network access, low privileges (authenticated user), and requires user interaction. The attacker can achieve limited confidentiality and integrity impacts by manipulating request headers. The vulnerability was patched in version 5.19.1 (released February 13, 2023). Affected versions are 2.0.0 through 5.19.0.
Affected products
- nodejs undici >=2.0.0 <5.19.1
Timeline
- 2023-02-16: disclosed: Vulnerability advisory published
- 2023-02-13: patched: Fixed in undici v5.19.1