undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side
    Request Forgery) when an application takes in **user input** into the `path/pathname` option of
    `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici
    = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of
    processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when
    `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to
    `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can
    result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change
    because the specified path parameter is combined with the base URL. This issue was fixed in
    `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request`
    call. (CVE-2022-35949)

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3251-1 advisory.

    - CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of     undici.request (bsc#1202382).
    - CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
    - CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives     when run in a workspace (bsc#1200517).
    - CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

    Bugfixes:

    - Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3250-1 advisory.

    - CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of     undici.request (bsc#1202382).
    - CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
    - CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives     when run in a workspace (bsc#1200517).
    - CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

    Bugfixes:

    - Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3196-1 advisory.

    - CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of     undici.request (bsc#1202382).
    - CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
    - CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives     when run in a workspace (bsc#1200517).
    - CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

    Bugfixes:

    - Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
412814	SCA: security update for undici (GHSA-8qr4-xgw6-wmr3)	Tenable Cloud Security	SCA Checks	critical
412814	SCA: security update for undici (GHSA-8qr4-xgw6-wmr3)	Tenable Self-Hosted Container Security	SCA Checks	critical
195166	GLSA-202405-29 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
164977	SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2022:3251-1)	Nessus	SuSE Local Security Checks	critical
164969	SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2022:3250-1)	Nessus	SuSE Local Security Checks	critical
164902	SUSE SLES12 Security Update : nodejs16 (SUSE-SU-2022:3196-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2022-35949

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical