Executive Summary

This vulnerability occurs in Undici's cache interceptor when it incorrectly classifies some HTTP responses as cacheable due to whitespace-padded field names in the Cache-Control header, such as private=" authorization" or no-cache=" authorization". The parser preserves the whitespace, causing it to fail to recognize these fields properly. As a result, responses that should not be cached are stored in the cache.

In shared-cache mode, this flaw allows a response containing one user's authenticated data to be served from the cache to another user, including unauthenticated users, if both requests share the same cache key.

The vulnerability affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-standard whitespace-padded private or no-cache directives.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to cross-user information disclosure by serving authenticated data from one user to another user, including unauthenticated users, due to improper caching.

Specifically, sensitive information intended for one user could be exposed to others if the application uses shared-cache mode with the affected Undici versions and the described cache-control headers.

This compromises confidentiality but does not affect integrity or availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should upgrade to undici version 7.28.0 or 8.5.0.

If upgrading is not immediately possible, consider the following workarounds:

• Disable shared-cache mode for traffic that includes Authorization headers.
• Avoid caching responses to authenticated requests.
• Add the header 'Vary: Authorization' upstream to prevent improper caching.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access to cached authenticated user data by serving one user's sensitive information to another user, including unauthenticated callers. Such unintended disclosure of sensitive information can lead to violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over the confidentiality and privacy of personal and health-related data.

Specifically, the issue arises when the cache interceptor incorrectly caches responses containing sensitive authorization data due to improper handling of Cache-Control headers with whitespace-padded directives. This can result in cross-user information disclosure, undermining compliance requirements for data confidentiality and access controls.

Mitigations such as upgrading to fixed versions, disabling shared-cache mode for authorized traffic, or adding appropriate cache control headers are necessary to maintain compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves incorrect caching behavior in undici's cache interceptor when Cache-Control headers contain whitespace-padded private or no-cache directives. Detection involves identifying if your system uses vulnerable undici versions (7.0.0 through 7.27.0 or 8.0.0 through 8.4.0) with shared-cache mode enabled and forwarding Authorization headers upstream.

To detect potential exploitation or presence of this vulnerability on your network or system, you can:

• Check the version of undici in use to confirm if it is within the vulnerable range.
• Inspect HTTP response headers for Cache-Control directives that include whitespace-padded private or no-cache fields, such as "private=" authorization"" or "no-cache="\tauthorization"".
• Monitor cache hits for responses that should not be cached, especially those involving Authorization headers.

Example commands to assist detection:

• Use curl or similar tools to inspect Cache-Control headers in responses: curl -I https://your.service/endpoint | grep -i Cache-Control
• Use network traffic analysis tools (e.g., tcpdump, Wireshark) to capture and analyze HTTP headers for suspicious Cache-Control directives.
• Check your application's package.json or dependency lock files to identify the undici version: grep undici package.json package-lock.json yarn.lock
• Review application logs or cache logs for unexpected cache hits on authenticated requests.

Useful 0 Not Useful 0