Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability exists in the undici library, a Node.js HTTP client, affecting its cache interceptor. This flaw could allow sensitive information, such as private response bodies and headers, to be inadvertently disclosed to unintended parties when improperly configured cache directives are used. In some cases, the issue could also cause applications to terminate unexpectedly.
- Sensitive data exposure via cache.
- Affects applications using undici's cache interceptor.
- Confirm relevance and exposure to sensitive data.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by sending specially crafted Cache-Control headers to an application using the undici HTTP client library's cache interceptor. If the application processes these headers, it may inadvertently store sensitive information or crash, depending on the exact malformation.
- Exposed to network traffic.
- Malformed Cache-Control header.
- Data disclosure or process termination.
Live Threat
Current exploitation, exposure, and threat context
When the cache interceptor is used in shared mode, malformed `Cache-Control` private directives could lead to sensitive response data being stored in the cache and later served to unintended users. Additionally, specific malformed `Cache-Control` headers can cause the application to crash. Both behaviors depend on the application's configuration and error handling when using the cache interceptor.
- Private response data could be exposed.
- Malformed directives could cause cache poisoning.
- Uncaught errors may terminate the process.
Operational Fix
Recommended remediation, mitigation, and detection steps
The `undici` library's cache interceptor is used in Node.js applications, so application owners and platform teams are likely responsible for addressing this vulnerability. The first step is to identify all instances where `undici` is utilized, confirm if the cache interceptor is enabled and accessible, and then plan remediation based on the criticality of affected services.
- Application owners should own the issue.
- Verify `undici` cache interceptor usage.
- Plan remediation considering business impact.
