https://github.com/nodejs/undici
At a glance
- Source
- NVD
- EPSS
- EPSS 0.47 % · percentile 40 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hackerone
- NVD status
- Modified
Description
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
Weaknesses (CWE)
- CWE-295 — Improper Certificate Validation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-pgw7-wx7w-2w33 — ProxyAgent vulnerable to MITM
European references
- ENISA EUVD · EUVD-2022-6112
- GCVE · GCVE-0-2022-32210
Affected configurations (NVD CPE)
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*≥ 4.8.2 < 5.5.1
Affected products
| Product | Versions |
|---|---|
| https://github.com/nodejs/undici | affected Fixed in version >= v5.5.1. Vulnerable between v4.8.2 and v5.5.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |