Junglewise Threat Intelligence

CVE-2024-24758: Node.js Undici Proxy-Authorization header leak on cross-origin redirect

CVE-2024-24758 · Severity: low · CVSS 3.1 · Published 2024-02-16

Executive brief

Undici, a popular HTTP client for Node.js, failed to properly clear proxy authentication credentials when a web request was redirected to a different website. This could allow a malicious third-party site to capture sensitive proxy login information if a user or automated process is redirected to it. This vulnerability primarily impacts the confidentiality of proxy credentials used within Node.js applications.

Technical details

A vulnerability exists in Undici's fetch implementation where the 'Proxy-Authorization' HTTP header is not cleared during cross-origin redirects. While Undici correctly clears the standard 'Authorization' header in these scenarios, the failure to remove proxy credentials violates the expected security boundaries defined in the Fetch standard. An attacker who controls a destination URL can receive these credentials if a request is redirected from a trusted origin to an attacker-controlled origin. This is classified as an exposure of sensitive information (CWE-200). The issue is resolved in versions 5.28.3 and 6.6.1 by explicitly deleting the 'proxy-authorization' header during the redirect handling logic.

Affected products

  • Node.js undici <= 5.28.2, 6.0.0 <= 6.6.0

Timeline

  • 2024-02-16: advisory: GitHub Security Advisory published
  • 2024-02-16: patched: Fixes released in versions 5.28.3 and 6.6.1

References