[23] Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect #443

New issue

Closed

opened 2024-06-24 18:39:18 +01:00 by Helpdesk · 0 comments

Helpdesk commented

2024-06-24 18:39:18 +01:00

Member

Package: undici (npm)
Affected versions: < 5.28.4
Patched version: 5.28.4

https://github.com/Vylpes/vylbot-app/security/dependabot/23

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been temptered.

Patches

Fixed in nodejs/undici.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tamptered with.

References

https://hackerone.com/reports/2377760

Package: undici (npm) Affected versions: < 5.28.4 Patched version: 5.28.4 https://github.com/Vylpes/vylbot-app/security/dependabot/23 --- ## Impact If an attacker can alter the `integrity` option passed to `fetch()`, they can let `fetch()` accept requests as valid even if they have been temptered. ## Patches Fixed in [nodejs/undici](https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3). Fixes has been released in v5.28.4 and v6.11.1. ## Workarounds Ensure that `integrity` cannot be tamptered with. ## References - https://hackerone.com/reports/2377760