CVE-2024-30261: Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
Impact
If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.
Patches
Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3. Fixes has been released in v5.28.4 and v6.11.1.
Workarounds
Ensure that integrity cannot be tampered with.
References
https://hackerone.com/reports/2377760
Other sources
Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
— NVD
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 6.11.1 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 5.28.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.14.0-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.2-1 - Upgrade
Upgrade
nodejs/undicito a version that resolves this vulnerability.Fixed in 5.28.4 - Upgrade
Upgrade
nodejs/undicito a version that resolves this vulnerability.Fixed in 6.11.1 - Compensating control
Ensure that the `integrity` option passed to `fetch()` cannot be tampered with (so `fetch()` does not accept tampered requests as valid).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30261?
CVE-2024-30261 is considered a significant vulnerability as it allows attackers to manipulate the integrity of fetch requests.
How do I fix CVE-2024-30261?
To fix CVE-2024-30261, update the undici package to version 6.11.1 or later.
Which versions of undici are affected by CVE-2024-30261?
CVE-2024-30261 affects undici versions between 6.0.0 and 6.11.0, as well as any versions prior to 5.28.4.
What compatibility issues should I be aware of when addressing CVE-2024-30261?
When addressing CVE-2024-30261, ensure your application is compatible with undici version 6.11.1 or later.
How does CVE-2024-30261 affect fetch requests?
CVE-2024-30261 allows fetch requests to be deemed valid even if they have been tampered with, compromising data integrity.