CVE-2024-30260 Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
Attackers can steal sensitive authentication headers when using specific Undici methods during cross-origin redirects.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-30260?
CVE-2024-30260 is a low-severity vulnerability in Fedoraproject Fedora, published on 4 Apr 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
Which versions are affected by CVE-2024-30260?
4 open source packages ship an affected version, including undici. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
undici npm | All versions | 5.28.4 |
undici npm | All versions | 5.28.4 |
undici npm | From 6.0.0 | 6.11.1 |
undici npm | From 6.0.0 | 6.11.1 |
Linux distribution packages (1)
nodejs-electron openSUSE:Tumbleweed | All versions | 28.2.10-2.1 |
Products include Fedoraproject Fedora, Nodejs Undici.
How do I fix CVE-2024-30260?
Upgrade undici to a fixed version for your release line: 5.28.4 or 6.11.1.
Is CVE-2024-30260 being exploited?
There is no known exploitation of CVE-2024-30260 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-39734, AZL-39803, DEBIAN-CVE-2024-30260, GHSA-m4v8-wqvr-p9f7, ROOT-APP-NPM-CVE-2024-30260, ROOT-OS-DEBIAN-12-CVE-2024-30260 and 2 more.