Vulnerability in undici (CVE-2022-32210)
Summary
Vulnerability in undici (CVE-2022-32210). Confidential information can be exposed externally. Exploitable via Undici.ProxyAgent. Mitigation: upgrade to 5.5.1 or later.
Original description
The description as published by the source.
Description
Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
Impact
This affects all use of HTTPS via HTTP proxy using Undici.ProxyAgent with Undici or Node's global fetch. In this case, it removes all HTTPS security from all requests sent using Undici's ProxyAgent, allowing trivial MitM attacks by anybody on the network path between the client and the target server (local network users, your ISP, the proxy, the target server's ISP, etc).
This less seriously affects HTTPS via HTTPS proxies. When you send HTTPS via a proxy to a remote server, the proxy can freely view or modify all HTTPS traffic unexpectedly (but only the proxy).
Patches
This issue was patched in Undici v5.5.1.
Workarounds
At the time of writing, the only workaround is to not use ProxyAgent as a dispatcher for TLS Connections.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2022-32210 has been found in undici.
Attackers can target a specific entry point like Undici.ProxyAgent over the network to misuse the product.
Confidential information can be exposed externally.
What to do: upgrade undici to 5.5.1 or later.
If unsure, ask your IT team or search "undici CVE-2022-32210" on the vendor's site.
CVE-2022-32210 (undici) — CWE-295
Attack vector: remote (network-reachable) / no user interaction
Attack surface: Undici.ProxyAgent / fetch / ProxyAgent
Patched: 5.5.1 — apply immediately
Workaround: At the time of writing, the only workaround is to not use ProxyAgent as a dispatcher for TLS Connections.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-295) exists in undici. Attackers reach the vulnerable code path via Undici.ProxyAgent.
Check the vendor advisory for the affected versions of undici. Attack surface: Undici.ProxyAgent / fetch / ProxyAgent.
Severity: ?. Confidential information can be exposed externally.
Update to 5.5.1.
Workaround: At the time of writing, the only workaround is to not use ProxyAgent as a dispatcher for TLS Connections.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'undici' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'undici' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
undiciを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
At the time of writing, the only workaround is to not use `ProxyAgent` as a dispatcher for TLS Connections.パッチが適用されるまでの応急処置として、At the time of writing, the only workaround is to not use
ProxyAgentas a dispatcher for TLS Connections. を実施。回避策の副作用 (機能低下) を確認した上で。 -
3Apply patch patch
Upgrade undici to 5.5.1ステージング環境で 5.5.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-32210 node-undici Fixed in: 5.6.1+dfsg1+~cs18.9.16-1
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web hackerone.com