Origin Validation Error Affecting undici package, versions >=7.0.0 <7.30.2>=8.0.0 <8.12.4

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Origin Validation Error via the cache interceptor in lib/interceptor/cache.js when an Agent composes the redirect and shared cache interceptors as compose(redirect(), cache()). The redirect handler strips origin-bound credential headers from a conditional revalidation request but does not strip the cache-generated If-None-Match or If-Modified-Since validators, so when the original origin redirects the revalidation request to a different origin, the redirect destination receives the original origin's validators. undici then treats a 304 Not Modified response from that different origin as successful revalidation of the stored representation, allowing a shared cache to serve the original origin's authenticated response - including one gated by Authorization - to a subsequent unauthenticated caller.

Note: This is only exploitable when a shared MemoryCacheStore or SqliteCacheStore and the composition compose(redirect(), cache()) are used, and an attacker can influence a cross-origin redirect on the revalidated request.

Compose the interceptors as compose(cache(), redirect()), use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

• GitHub Commit (>=8.0.0 <8.12.4)
• Maintainer's Advisory