Insertion of Sensitive Information into Log File Affecting undici package, versions >=7.0.0 <7.30.2>=8.0.0 <8.12.4

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the cleanRequestHeaders function in lib/handler/redirect-handler.js, when request headers are supplied as an array of [name, value] tuples (e.g. via Object.entries(headers)). The redirect interceptor is responsible for stripping sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host on cross-origin redirects, but it misreads tuple-format headers as a flat alternating [name, value, name, value, ...] list, causing header names to never match the strip list and leaving sensitive headers intact. When a header-normalizing interceptor such as cache() or deduplicate() is composed outside redirect(), it serializes the retained headers onto the cross-origin request, disclosing origin-bound credentials to the redirect destination. This is a representation-dependent bypass of the cross-origin header stripping introduced to address CVE-2024-30260.

Note: This is only exploitable when headers are supplied as an array of [name, value] tuples and a header-normalizing interceptor (cache() or deduplicate()) is composed outside the redirect() interceptor.

Supply request headers as a plain object or a flat [name, value, name, value, ...] array rather than an array of [name, value] tuples, or compose the redirect() interceptor outside the normalizing interceptor (cache() or deduplicate()).

• GitHub Commit (>=8.0.0 <8.12.4)
• Maintainer's Advisory