GHSA-v3r7-h72x-cjcm: CSRF
Impact
The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons (validateCookiePath already does at 0x3B), so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks each entry contains = and does not sanitize values, so an entry like X-Custom=val; HttpOnly lands unchanged, injecting HttpOnly without the caller setting cookie.httpOnly = true.
Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, Secure or HttpOnly forced or stripped, or the intended SameSite tier overridden.
Patches
Patched in undici v6.28.0, v7.29.0, and v8.9.0.
Workarounds
- Sanitize domain values against the RFC 1034 letter-digit-hyphen set before passing to setCookie. - Do not pass user-controlled data to the unparsed field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 8.9.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.29.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 6.28.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.28.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.29.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.9.0 - Configuration
Ensure calls to `setCookie` do not pass user-controlled input into the `unparsed` attribute list (since `unparsed` entries are only checked for containing `=` and are otherwise not sanitized).
undici setCookie unparsed = Do not pass user-controlled data - Configuration
Before calling `setCookie`, sanitize the `domain` value so it only contains the RFC 1034 letter-digit-hyphen set (to prevent semicolon-based injection such as `example.com; SameSite=None`).
undici setCookie domain = Sanitize to RFC 1034 letter-digit-hyphen set
Event History
Frequently Asked Questions
What is the severity of GHSA-v3r7-h72x-cjcm?
The severity of GHSA-v3r7-h72x-cjcm is medium with a score of 4.8.
How do I fix GHSA-v3r7-h72x-cjcm?
To fix GHSA-v3r7-h72x-cjcm, update to the latest version of npm/undici that addresses this vulnerability.
What are the impacts of GHSA-v3r7-h72x-cjcm?
The impacts of GHSA-v3r7-h72x-cjcm include potential cookie attribute injection that could affect security settings.
Which function is affected by GHSA-v3r7-h72x-cjcm?
The setCookie function is affected by GHSA-v3r7-h72x-cjcm due to vulnerabilities in its attribute handling.
Is GHSA-v3r7-h72x-cjcm related to CSRF?
Yes, GHSA-v3r7-h72x-cjcm is categorized under CSRF (Cross-Site Request Forgery) vulnerabilities.