CVE-2024-30260: Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
First published: Thu Apr 04 2024(Updated: )
### Impact Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. ### Patches This has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75. Fixes has been released in v5.28.4 and v6.11.1. ### Workarounds use `fetch()` or disable `maxRedirections`. ### References Linzi Shang reported this. * https://hackerone.com/reports/2408074 * https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/undici | >=6.0.0<6.11.1 | 6.11.1 |
| npm/undici | <5.28.4 | 5.28.4 |
| Node.js | <5.28.4 | |
| Node.js | >=6.0.0<6.11.1 | |
| Red Hat Fedora | =38 | |
| Red Hat Fedora | =39 | |
| Red Hat Fedora | =40 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7
- https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f
- https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ/
- https://hackerone.com/reports/2408074
- https://nvd.nist.gov/vuln/detail/CVE-2024-30260
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E
- https://github.com/advisories/GHSA-m4v8-wqvr-p9f7 (Advisory)
- https://www.ibm.com/support/pages/node/7182403 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-30260?
CVE-2024-30260 is currently classified with a moderate severity level due to the potential exposure of sensitive headers.
How do I fix CVE-2024-30260?
To fix CVE-2024-30260, update the 'undici' package to version 6.11.1 or later.
Which software is affected by CVE-2024-30260?
CVE-2024-30260 affects IBM Cloud Pak for Security versions up to 1.10.11.0 and IBM QRadar Suite Software versions up to 1.10.23.0, among others.
What component of my application is vulnerable in CVE-2024-30260?
The vulnerability in CVE-2024-30260 is in the 'undici' library, specifically affecting authorization and proxy-authorization headers.
Is there a patch for CVE-2024-30260?
Yes, the issue in CVE-2024-30260 has been patched in the commits made to the undici repository, and these patches have been released in newer versions.
- agent/first-publish-date
- agent/title
- agent/type
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-m4v8-wqvr-p9f7
- alias/CVE-2024-30260
- agent/software-canonical-lookup
- agent/trending
- collector/github-advisory
- agent/source
- collector/ibm-support
- source/IBM
- agent/severity
- agent/references
- agent/last-modified-date
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/npm
- vendor/nodejs
- canonical/node.js
- version/node.js/6.0.0
- vendor/fedoraproject
- canonical/red hat fedora
- version/red hat fedora/38
- version/red hat fedora/39
- version/red hat fedora/40