CVE-2022-35948 : Security Advisory and Response

Undici, an HTTP/1.1 client for Node.js, specifically versions equal to or below 5.8.0, is vulnerable to CRLF Injection in the

content-type

header. This vulnerability allows an attacker to inject malicious headers. It was patched in Undici v5.8.1. Here's what you need to know about CVE-2022-35948.

Understanding CVE-2022-35948

In this section, we will delve into the specifics of CVE-2022-35948.

What is CVE-2022-35948?

Undici, a Node.js HTTP/1.1 client, is prone to CRLF Injection attacks in the

content-type

header when unsanitized inputs are used as request headers. This could lead to security compromises by injecting malicious headers.

The Impact of CVE-2022-35948

The impact of this vulnerability is significant as it allows attackers to manipulate headers, potentially leading to attacks like request smuggling or response splitting. This could result in various security breaches and data manipulation.

Technical Details of CVE-2022-35948

This section will cover the technical aspects of CVE-2022-35948.

Vulnerability Description

The vulnerability arises from the improper handling of CRLF sequences in the

content-type

header. Attackers can exploit this to insert additional headers in the HTTP request, compromising the integrity of the communication.

Affected Systems and Versions

Node.js users utilizing Undici version 5.8.0 or below are vulnerable to this CRLF Injection vulnerability. It is essential to upgrade to Undici v5.8.1 or newer to mitigate the risk.

Exploitation Mechanism

By sending crafted HTTP requests with malicious input in the

content-type

header, attackers can manipulate headers, potentially leading to various attacks.

Mitigation and Prevention

In this section, we will discuss the steps to mitigate and prevent CVE-2022-35948.

Immediate Steps to Take

Users are advised to update Undici to version 5.8.1 or above to patch the vulnerability. Additionally, sanitize user inputs when using them as content-type headers to prevent exploitation.

Long-Term Security Practices

Implement secure coding practices such as input validation and output encoding to prevent CRLF Injection vulnerabilities in web applications.

Patching and Updates

Regularly check for security updates and apply patches promptly to ensure the security of your Node.js applications.