Executive brief
Undici is a Node.js HTTP client library used for making web requests, including fetch operations. A vulnerability causes sensitive authentication cookies to be leaked to third-party sites when a redirect occurs across different origins—for example, if a malicious site triggers a redirect or an open redirector is exploited. An attacker controlling the redirect target could harvest cookies intended only for the original site.
Technical details
Undici's fetch implementation does not clear Cookie headers during cross-origin redirects, despite clearing Authorization headers. While browser specifications forbid setting Cookie headers directly in RequestInit.headers, Undici handles headers more permissively than the specification, creating a gap in the redirect logic. When a redirect (3xx response) points to a different origin, cookies from the original request are forwarded to the new destination. An attacker can exploit this by controlling a redirect target or via an open redirector on a trusted site. The vulnerability requires network access and user interaction (triggering the redirect). Patches were released in Undici v5.26.2 (commit e041de359).
Affected products
- Node.js Undici < 5.26.2
Timeline
- 2023-10-12: disclosed: CVE-2023-45143 published
- 2023-10-16: disclosed: GitHub advisory GHSA-wqq4-5wpv-mx2g published
- 2023-10-16: patched: Patch released in v5.26.2