low3.9

CVE-2023-45143

Undici's cookie header not cleared on cross-origin redirect in fetch

Impact

### Impact Undici clears Authorization headers on cross-origin redirects, but does not clear `Cookie` headers. By design, `cookie` headers are [forbidden request headers](https://fetch.spec.whatwg.org/#forbidden-request-header), disallowing them to be set in `RequestInit.headers` in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. ### Patches This was patched in [e041de359221ebeae04c469e8aff4145764e6d76](https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76), which is included in version 5.26.2.

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`undici`	< 5.26.2	5.26.2

Affected products

Vendor	Product	Affected versions
Nodejs	Undici	before 5.26.2
Fedoraproject	Fedora	Versions 37, 38, 39

Weakness classification

CWE-200

Impact

Affected packages

Affected products

Weakness classification

References