CVE-2022-31151: Uncleared cookies on cross-host/cross-origin redirect in undici
A flaw was found in the undici package. After cookie headers are set, they are not cleared. This issue could allow an attacker to take advantage of this cookie, which could be used to control the redirection target.
Other sources
Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. maxRedirections: 0 (the default).
In undici < 5.7.1, cookie headers remain uncleared on cross-origin redirect. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker, who can control the redirection target (ie. an open redirector), in order to leak the cookie to the 3rd party site.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/undicito a version that resolves this vulnerability.Fixed in 5.7.1 - Upgrade
Upgrade
debian/node-undicito a version that resolves this vulnerability.Fixed in 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4Fixed in 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3Fixed in 7.3.0+dfsg1+~cs24.12.11-1Fixed in 8.12.2+dfsg+~cs3.2.3-2 - Upgrade
Upgrade
debian/node-undicito a version that resolves this vulnerability.Fixed in 5.8.0+dfsg1+~cs18.9.16-1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 5.7.1 - Configuration
Do not enable redirections; set maxRedirections to 0.
undici maxRedirections = 0
Event History
Frequently Asked Questions
What is CVE-2022-31151?
CVE-2022-31151 is a vulnerability in the undici package that allows for accidental leakage of cookies to a third-party site during cross-origin redirects.
How severe is CVE-2022-31151?
CVE-2022-31151 has a severity score of 6.5, which is considered medium.
What software is affected by CVE-2022-31151?
The undici package version up to and excluding 5.7.1 is affected by CVE-2022-31151, as well as Node.js Undici versions up to and excluding 5.7.1.
How do I fix CVE-2022-31151?
To fix CVE-2022-31151, you should update the undici package or Node.js Undici to version 5.7.1 or later.
Where can I find more information about CVE-2022-31151?
You can find more information about CVE-2022-31151 on the Red Hat website, including the associated security advisory (RHSA-2022:6696) and the Bugzilla entry.