QwikSec

Security Database

CVE

CWE

Training

CVE-2022-32210

Published: Jul 14, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

Vendor	Product	Versions
n/a	https://github.com/nodejs/undici	affected `Fixed in version >= v5.5.1. Vulnerable between v4.8.2 and v5.5.0`

Weaknesses (CWE)

References

https://hackerone.com/reports/1583680

x_refsource_MISC

https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.