Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-24758

CVE-2024-24758: Undici proxy-authorization header not cleared on cross-origin redirect in fetch

3.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-24758
GHSA ID
GHSA-3787-6prv-h9w3
EPSS Score
0.29535%
CWE
CWE-200
Published
2/16/2024
Updated
5/2/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
undicinpm<= 5.28.25.28.3
undicinpm>= 6.0.0, <= 6.6.06.6.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit diff shows the vulnerability was patched by adding 'request.headersList.delete("proxy-authorization", true)' in lib/fetch/index.js within the httpRedirectFetch function. This function is responsible for handling redirect logic and previously only cleared Authorization headers. The test file modification also verifies Proxy-Authorization header clearance was missing in redirect handling. The function's role in processing cross-origin redirects and its direct modification in the security patch confirm it as the vulnerable component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Un*i*i *lr***y *l**r** *ut*oriz*tion *****rs on *ross-ori*in r**ir**ts, *ut *i* not *l**r `Proxy-*ut*oriz*tion` *****rs. ### P*t***s T*is is p*t**** in v*.**.* *n* v*.*.* ### Work*roun*s T**r* *r* no known work*roun*s. ### R***r*n**

Reasoning

T** *ommit *i** s*ows t** vuln*r**ility w*s p*t**** *y ***in* 'r*qu*st.*****rsList.**l*t*("proxy-*ut*oriz*tion", tru*)' in `li*/**t**/in**x.js` wit*in t** `*ttpR**ir**t**t**` *un*tion. T*is *un*tion is r*sponsi*l* *or **n*lin* r**ir**t lo*i* *n* pr*v