CVE-2022-35948 CRLF Injection in Nodejs ‘undici’ via Content-Type
MediumCVSS 5.3
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
undici is an HTTP/1.1 client, written from scratch for Node.js.=< undici@5.8.0 users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header. Example: import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) The above snippet will perform two requests in a single request API call: 1) http://localhost:3000/ 2) http://localhost:3000/foo2 This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm undici(npm) | <= 5.8.1 | No fix listed |
| debian/node-undici(Debian:12) | < 5.8.2+dfsg1+~cs18.9.18.1-1 | 5.8.2+dfsg1+~cs18.9.18.1-1 |
| debian/node-undici(Debian:13) | < 5.8.2+dfsg1+~cs18.9.18.1-1 | 5.8.2+dfsg1+~cs18.9.18.1-1 |
| debian/node-undici(Debian:14) | < 5.8.2+dfsg1+~cs18.9.18.1-1 | 5.8.2+dfsg1+~cs18.9.18.1-1 |
| nodejs undici | = =< 5.8.0 | No fix listed |
| nodejs undici | < 5.8.2 | 5.8.2 |
References
- github.com exploit third-party-advisory vendor-advisory
- nvd.nist.gov third-party-advisory
- github.com patch third-party-advisory
- github.com release-notes third-party-advisory
- github.com
- Debian Security Tracker CVE-2022-35948 vendor-advisory