Log in Start free

Vulnerability · Published Oct 12, 2023 · Assigned by GitHub_M

CVE-2023-45143Undici's cookie header not cleared on cross-origin redirect in fetch

Low 3.9

In plain English

A low-severity information exposure in undici from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.9Low
Exploit odds (30 days)1.4%top 28.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8nodejs1:18.18.2-1.module_el8.8.0+3652+0e111ba0ALSA-2023:5869
AlmaLinux:8nodejs1:20.8.1-1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:9nodejs1:18.18.2-2.module_el9.2.0+43+3ebc9e20ALSA-2023:5849
AlmaLinux:8nodejs-devel1:20.8.1-1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:8nodejs-devel1:18.18.2-1.module_el8.8.0+3652+0e111ba0ALSA-2023:5869
AlmaLinux:9nodejs-devel1:18.18.2-2.module_el9.2.0+43+3ebc9e20ALSA-2023:5849
AlmaLinux:8nodejs-docs1:20.8.1-1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:8nodejs-docs1:18.18.2-1.module_el8.8.0+3652+0e111ba0ALSA-2023:5869
AlmaLinux:9nodejs-docs1:18.18.2-2.module_el9.2.0+43+3ebc9e20ALSA-2023:5849
AlmaLinux:8nodejs-full-i18n1:18.18.2-1.module_el8.8.0+3652+0e111ba0ALSA-2023:5869
AlmaLinux:8nodejs-full-i18n1:20.8.1-1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:9nodejs-full-i18n1:18.18.2-2.module_el9.2.0+43+3ebc9e20ALSA-2023:5849
AlmaLinux:8nodejs-nodemon3.0.1-1.module_el8.8.0+3613+1ed8c91dALSA-2023:5869
AlmaLinux:8nodejs-nodemon3.0.1-1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:9nodejs-nodemon3.0.1-1.module_el9.2.0+36+853e48f5ALSA-2023:5849
AlmaLinux:8nodejs-packaging2021.06-4.module_el8.7.0+3343+ea2b7901ALSA-2023:5869
AlmaLinux:8nodejs-packaging2021.06-4.module_el8.9.0+3684+11b9e959ALSA-2023:7205
AlmaLinux:9nodejs-packaging2021.06-4.module_el9.1.0+13+d9a595eaALSA-2023:5849
AlmaLinux:8nodejs-packaging-bundler2021.06-4.module_el8.7.0+3343+ea2b7901ALSA-2023:5869
AlmaLinux:8nodejs-packaging-bundler2021.06-4.module_el8.9.0+3684+11b9e959ALSA-2023:7205
AlmaLinux:9nodejs-packaging-bundler2021.06-4.module_el9.1.0+13+d9a595eaALSA-2023:5849
AlmaLinux:8npm1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:8npm1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0ALSA-2023:5869
AlmaLinux:9npm1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20ALSA-2023:5849
Alpine:v3.20nodejs18.18.2-r0ALPINE-CVE-2023-45143
Alpine:v3.21nodejs18.18.2-r0ALPINE-CVE-2023-45143
Alpine:v3.22nodejs18.18.2-r0ALPINE-CVE-2023-45143
Alpine:v3.23nodejs18.18.2-r0ALPINE-CVE-2023-45143
Alpine:v3.24nodejs18.18.2-r0ALPINE-CVE-2023-45143
Alpine:v3.20nodejs-current20.8.1-r0ALPINE-CVE-2023-45143
Alpine:v3.21nodejs-current20.8.1-r0ALPINE-CVE-2023-45143
Alpine:v3.22nodejs-current20.8.1-r0ALPINE-CVE-2023-45143
Alpine:v3.23nodejs-current20.8.1-r0ALPINE-CVE-2023-45143
Alpine:v3.24nodejs-current20.8.1-r0ALPINE-CVE-2023-45143
Alpine:v3.20openjdk2121.0.2_p13-r0ALPINE-CVE-2023-45143
Alpine:v3.21openjdk2121.0.2_p13-r0ALPINE-CVE-2023-45143
Alpine:v3.22openjdk2121.0.2_p13-r0ALPINE-CVE-2023-45143
Alpine:v3.23openjdk2121.0.2_p13-r0ALPINE-CVE-2023-45143
Alpine:v3.24openjdk2121.0.2_p13-r0ALPINE-CVE-2023-45143
Debian:12node-undici5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2DEBIAN-CVE-2023-45143
Debian:13node-undici5.26.3+dfsg1+~cs23.10.12-1DEBIAN-CVE-2023-45143
Debian:14node-undici5.26.3+dfsg1+~cs23.10.12-1DEBIAN-CVE-2023-45143
Rocky Linux:8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1824+532140eeRLSA-2023:5869
Rocky Linux:8nodejs-nodemon0:3.0.1-1.module+el8.8.0+1459+02651ab6RLSA-2023:7205
Rocky Linux:8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1989+e60144d9RLSA-2023:5869
Rocky Linux:8nodejs-nodemon0:3.0.1-1.module+el8.10.0+1988+437f3d23RLSA-2023:5869
Rocky Linux:8nodejs-nodemon0:3.0.1-1.module+el8.9.0+1760+903d54b9RLSA-2023:5869
Rocky Linux:9nodejs-nodemon0:3.0.1-1.module+el9.7.0+40018+a011993dRLSA-2023:5849
Rocky Linux:9nodejs-nodemon0:3.0.1-1.module+el9.7.0+40017+f0db1785RLSA-2023:5849
Rocky Linux:9nodejs-nodemon0:3.0.1-1.module+el9.7.0+40022+9ecc286cRLSA-2023:5849
Rocky Linux:8nodejs-packaging0:2021.06-4.module+el8.10.0+1989+e60144d9RLSA-2023:5869
Rocky Linux:8nodejs-packaging0:2021.06-4.module+el8.7.0+1072+5b168780RLSA-2023:7205
Rocky Linux:8nodejs-packaging0:2021.06-4.module+el8.10.0+1824+532140eeRLSA-2023:5869
Rocky Linux:8nodejs-packaging0:2021.06-4.module+el8.10.0+1988+437f3d23RLSA-2023:5869
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.7.0+40025+0e0cf6b2RLSA-2023:5849
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.7.0+40017+f0db1785RLSA-2023:5849
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.7.0+40018+a011993dRLSA-2023:5849
Rocky Linux:9nodejs-packaging0:2021.06-4.module+el9.7.0+40022+9ecc286cRLSA-2023:5849
Ubuntu:24.04:LTSnode-undicino fix listedUBUNTU-CVE-2023-45143
npmundici5.26.2GHSA-wqq4-5wpv-mx2g

Affected products (as reported)

VendorProductVersions
nodejs undici < 5.26.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References