🐛 BUG: CVE-2022-31150

[imhunterand]

What version of Wrangler are you using?

5.5.1

What operating system are you using?

undici (npm)

Describe the Bug

on undici in package-lock.json. upgrade undici to version 5.8.0 or later. For example:

"dependencies": {
  "undici": ">=5.8.0"
}

"devDependencies": {
  "undici": ">=5.8.0"
}

Impact

It is possible to inject CRLF sequences into request headers in Undici.

const undici = require('undici')

const response = undici.request("http://127.0.0.1:1000", {
  headers: {'a': "\r\nb"}
})

The same applies to path and method

Patches

Update to v5.8.0

Workarounds Sanitize all HTTP headers from untrusted sources to eliminate \r\n.

References

https://hackerone.com/reports/409943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116

For more information

If you have any questions or comments about this advisory:

Open an issue in undici repository To make a report, follow the SECURITY document