Executive brief
Undici is a Node.js HTTP client library used by many applications to make secure requests. The library implements Subresource Integrity (SRI) checking to ensure downloaded resources haven't been tampered with. An attacker who can modify the integrity parameter passed to fetch() can bypass this validation, allowing tampered content to be accepted as legitimate, potentially leading to code execution or data corruption.
Technical details
The vulnerability is a Subresource Integrity (SRI) validation bypass in Undici's fetch implementation (CWE-657). When a hash algorithm is specified in the integrity option but the hash value is malformed or incorrect, the validation logic incorrectly accepts the request as valid instead of rejecting it. This allows an attacker with the ability to control the integrity parameter (requiring low privileges and user interaction) to bypass SRI checks, potentially accepting tampered resources. The flaw affects versions before 5.28.4 and from 6.0.0 through 6.11.0, with patches released in v5.28.4 and v6.11.1.
Affected products
- Node.js Undici < 5.28.4 and >= 6.0.0 <= 6.11.0
Timeline
- 2024-04-04: disclosed
- 2024-04-04: patched: Fixed in versions 5.28.4 and 6.11.1