CVE-2022-32210
N/A
N/A
Summary
Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | https://github.com/nodejs/undici | Fixed in version >= v5.5.1. Vulnerable between v4.8.2 and v5.5.0 | affected |
Weaknesses
- CWE-295: Improper Certificate Validation (CWE-295)
ADP Enrichment
CVE Program Container
Additional References
- https://hackerone.com/reports/1583680
- https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33
References
- https://hackerone.com/reports/1583680
- https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.