CVE-2024-30260: Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
Impact
Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().
Patches
This has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75. Fixes has been released in v5.28.4 and v6.11.1.
Workarounds
use fetch() or disable maxRedirections.
References
Linzi Shang reported this.
https://hackerone.com/reports/2408074 https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3
Other sources
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request(). This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
— NVD
Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch request stream pipeline
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30260?
CVE-2024-30260 is currently classified with a moderate severity level due to the potential exposure of sensitive headers.
How do I fix CVE-2024-30260?
To fix CVE-2024-30260, update the 'undici' package to version 6.11.1 or later.
Which software is affected by CVE-2024-30260?
CVE-2024-30260 affects IBM Cloud Pak for Security versions up to 1.10.11.0 and IBM QRadar Suite Software versions up to 1.10.23.0, among others.
What component of my application is vulnerable in CVE-2024-30260?
The vulnerability in CVE-2024-30260 is in the 'undici' library, specifically affecting authorization and proxy-authorization headers.
Is there a patch for CVE-2024-30260?
Yes, the issue in CVE-2024-30260 has been patched in the commits made to the undici repository, and these patches have been released in newer versions.