Authorization Bypass Through User-Controlled Key Affecting undici package, versions >=7.0.0 <7.30.2>=8.0.0 <8.12.4

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the CacheHandler.onResponseStart function in the cache handler. With an originless Agent using a shared cache and compose(redirect(), cache()), when a credential-bearing request to a user-specific URL receives a same-origin redirect to a cacheable per-user resource, the response is stored under the original URL without varying on credentials. A later authenticated or unauthenticated caller requesting that URL receives the first user’s private response from the cache.

Notes

• The shared cache must be a MemoryCacheStore or SqliteCacheStore; the advisory identifies these stores as the affected cache implementations.

Workarounds

• Compose the interceptors as compose(cache(), redirect()) to prevent redirected per-user responses from being cached under the original request URL.
• Use per-origin dispatchers and cache stores to prevent a shared cache from serving one origin’s user-specific response to callers of another.
• Disable shared caching for credential-bearing requests that can follow redirects to prevent private responses from being reused for other callers.
• Set appropriate Vary headers on per-user responses, or mark them private or no-store, to prevent shared-cache reuse across users.

• Maintainer's Advisory
• Vendor Advisory