Undici's cookie header not cleared on cross-origin redirect in fetch #359

New issue

Closed

opened 2023-10-17 17:07:10 +01:00 by Vylpes · 0 comments

Vylpes commented

2023-10-17 17:07:10 +01:00

Owner

Package: undici (npm)
Affected versions: < 5.26.2
Patched version: 5.26.2

Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.

As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Package: undici (npm) Affected versions: < 5.26.2 Patched version: 5.26.2 --- Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Vylpes added the

type

dependencies

label 2023-10-17 17:07:17 +01:00

Vylpes added this to the 3.1.2 milestone 2023-10-17 17:11:23 +01:00

Vylpes started working 2023-10-25 14:47:42 +01:00

Vylpes stopped working 2023-10-25 14:50:56 +01:00

3 minutes 14 seconds

Vylpes closed this issue

2023-10-25 14:51:13 +01:00

No milestone

No project

No assignees

1 participant

Notifications

Total time spent: 3 minutes 14 seconds

Vylpes

3 minutes 14 seconds

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: RabbitLabs/vylbot-app#359

No description provided.