Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a security vulnerability in the undici library used within Node.js. The issue arises when a specific component, BalancedPool, processes custom security options, potentially leading to the acceptance of unauthorized connections. While the vulnerability exists, its exploitation is dependent on specific implementation choices by developers.
- Custom security settings may be ignored.
- Affects how applications verify server identities.
- Confirm relevance and exposure within your Node.js use.
Attack Path
How an attacker could exploit the issue
An attacker can leverage this vulnerability by sending a request to an application that uses the vulnerable `BalancedPool` constructor within the `undici` library. If the application improperly configures `BalancedPool` with function-valued TLS options, these functions are discarded during JSON serialization. This allows an attacker to bypass custom server identity checks, potentially leading to Man-in-the-Middle attacks.
- No special access required for the attacker.
- Triggered by specific `BalancedPool` configuration.
- Allows bypassing server identity checks.
Live Threat
Current exploitation, exposure, and threat context
When the `undici` library's `BalancedPool` constructor is used with custom TLS options, such as a `checkServerIdentity` callback or a custom `connect` option, these functions are silently dropped due to JSON serialization. This could allow a peer with a certificate that should be rejected by the custom logic to be accepted if it passes Node.js's default checks, potentially leading to man-in-the-middle attacks when these specific, unsupported configurations are in use.
- Invalid TLS certificates could be accepted.
- Custom TLS validation logic may be bypassed.
- Application trust in network connections is undermined.
Operational Fix
Recommended remediation, mitigation, and detection steps
To address this vulnerability, application owners and platform teams should collaborate to identify instances of the affected Undici library within their Node.js deployments. The immediate priority is to confirm whether the vulnerable `BalancedPool` configuration, specifically with function-valued TLS options, is in use and if these instances are exposed externally or handle sensitive data. Once identified and prioritized by risk, a plan for upgrading the Undici library should be executed, potentially requiring coordination with development teams and scheduling during maintenance windows.
- Application owners and platform teams must own remediation.
- Verify usage of `BalancedPool` with function-valued TLS options.
- Upgrade to supported versions of Undici.
