CVE-2022-31151: Uncleared cookies on cross-host/cross-origin redirect in undici
First published: Wed Jul 20 2022(Updated: )
A flaw was found in the undici package. After cookie headers are set, they are not cleared. This issue could allow an attacker to take advantage of this cookie, which could be used to control the redirection target.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nodejs Undici | <5.7.1 |
Remedy
By default, this vulnerability is not exploitable. In order to make sure this is mitigated, do not enable redirections, i.e.: `maxRedirections: 0`
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/nodejs/undici/issues/872
- https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp
- https://hackerone.com/reports/1635514
- https://security.netapp.com/advisory/ntap-20220909-0006/
- https://access.redhat.com/errata/RHSA-2022:6696
- https://access.redhat.com/security/cve/cve-2022-31151
- https://bugzilla.redhat.com/show_bug.cgi?id=2121396
- https://www.cve.org/CVERecord?id=CVE-2022-31151 https://nvd.nist.gov/vuln/detail/CVE-2022-31151 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31151 https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp
Frequently Asked Questions
What is CVE-2022-31151?
CVE-2022-31151 is a vulnerability in the undici package that allows for accidental leakage of cookies to a third-party site during cross-origin redirects.
How severe is CVE-2022-31151?
CVE-2022-31151 has a severity score of 6.5, which is considered medium.
What software is affected by CVE-2022-31151?
The undici package version up to and excluding 5.7.1 is affected by CVE-2022-31151, as well as Node.js Undici versions up to and excluding 5.7.1.
How do I fix CVE-2022-31151?
To fix CVE-2022-31151, you should update the undici package or Node.js Undici to version 5.7.1 or later.
Where can I find more information about CVE-2022-31151?
You can find more information about CVE-2022-31151 on the Red Hat website, including the associated security advisory (RHSA-2022:6696) and the Bugzilla entry.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/remedy
- agent/weakness
- agent/author
- agent/references
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-31151
- agent/software-canonical-lookup
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/event
- agent/tags
- agent/first-publish-date
- vendor/nodejs
- canonical/nodejs undici
- package-manager/redhat