CVE-2023-23936 : Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

Published 2023-02-16 18:15:11

Updated 2023-02-24 19:14:28

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2023-23936

Nodejs » Node.js » LTS Edition
Versions from including (>=) 16.0.0 and before (<) 16.19.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Matching versions
Nodejs » Node.js » LTS Edition
Versions from including (>=) 18.0.0 and before (<) 18.14.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 19.0.0 and before (<) 19.6.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions
Nodejs » Undici » For Node.js
Versions from including (>=) 2.0.0 and before (<) 5.19.1
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-23936

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 51 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-23936

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	2.8	2.5	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	3.9	2.5	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2023-23936

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Assigned by: security-advisories@github.com (Secondary)

References for CVE-2023-23936

https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034

Merge pull request from GHSA-5r9g-qh6m-jxff · nodejs/undici@a2eff05 · GitHub
Patch
https://github.com/nodejs/undici/releases/tag/v5.19.1

Release v5.19.1 · nodejs/undici · GitHub
Release Notes

CVEs referencing this url
https://hackerone.com/reports/1820955

Just a moment...
Exploit;Third Party Advisory
https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff

CRLF Injection in Nodejs ‘undici’ via host · Advisory · nodejs/undici · GitHub
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-23936

Products affected by CVE-2023-23936

Exploit prediction scoring system (EPSS) score for CVE-2023-23936

CVSS scores for CVE-2023-23936

CWE ids for CVE-2023-23936

References for CVE-2023-23936