- Description
- ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }
- Source
- ce714d77-add3-4f53-aff5-83d477b104bb
- NVD status
- Analyzed
- Products
- undici
CVSS 3.1
- Type
- Secondary
- Base score
- 4.6
- Impact score
- 2.5
- Exploitability score
- 2.1
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- Severity
- MEDIUM
- ce714d77-add3-4f53-aff5-83d477b104bb
- CWE-93
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "C08CE582-019D-4A06-910A-6010C2D6EF4F",
"versionEndExcluding": "6.24.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "F016E7D9-C45A-4DEF-9AD8-F0581AF5E509",
"versionEndExcluding": "7.24.0",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]