Undici HTTP Client Integrity Bypass via fetch() - Fixed v5.28.4/6.11.1
CVE-2024-30261 Published on April 4, 2024
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
Vulnerability Analysis
CVE-2024-30261 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2024-30261. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2024-30261 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2024-30261
stack.watch emails you whenever new vulnerabilities are published in nodejs Undici or Fedora Project Fedora. Just hit a watch button to start following.
Affected Versions
nodejs undici:- Version >= 6.0.0, < 6.11.1 is affected.
- Version < 5.28.4 is affected.
- Version 6.0.0 and below 6.11.1 is affected.
- Before 5.28.4 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2024-30261
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| npm | undici | < 5.28.4 | 5.28.4 |
| npm | undici | >= 6.0.0, < 6.11.1 | 6.11.1 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.