CVE-2022-32210

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33	Exploit Third Party Advisory
https://hackerone.com/reports/1583680	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*

History

25 Jul 2022, 18:29

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
CPE		cpe:2.3:a:nodejs:undici::::::node.js::*
CWE		CWE-295
First Time		Nodejs Nodejs undici
References	~~(MISC) https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33 -~~	(MISC) https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33 - Exploit, Third Party Advisory
References	~~(MISC) https://hackerone.com/reports/1583680 -~~	(MISC) https://hackerone.com/reports/1583680 - Exploit, Issue Tracking, Third Party Advisory

14 Jul 2022, 15:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-07-14 15:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-32210

Mitre link : CVE-2022-32210

CVE.ORG link : CVE-2022-32210

JSON object : View

Products Affected

nodejs

undici

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2022-32210", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.2}]}, "published": "2022-07-14T15:15:08.183", "references": [{"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33", "tags": ["Exploit", "Third Party Advisory"], "source": "support@hackerone.com"}, {"url": "https://hackerone.com/reports/1583680", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server."}, {"lang": "es", "value": "\"Undici.ProxyAgent\" nunca verifica el certificado del servidor remoto, y siempre expone todos los datos de petici\u00f3n y respuesta al proxy. Esto significa inesperadamente que los proxies pueden MitM todo el tr\u00e1fico HTTPS, y si la URL del proxy es HTTP entonces tambi\u00e9n significa que las peticiones nominalmente HTTPS son realmente enviadas por medio de texto plano HTTP entre Undici y el servidor proxy"}], "lastModified": "2022-07-25T18:29:47.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "01EE431C-9AF4-4FF9-BB77-516E07FD8D18", "versionEndExcluding": "5.5.1", "versionStartIncluding": "4.8.2"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}