fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Low

mcollina published GHSA-9qxr-qj54-h672

Apr 4, 2024

Package

undici (npm)

Affected versions

< 5.28.3; > 6.0.0 <= 6.11.0

Patched versions

>= 5.28.4 < 6.0.0; >= 6.11.1

Description

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in d542b8c.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

Severity

Low

2.6

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

Low

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N