CVE-2022-35948: Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
value: undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.
CWE description: The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CVSS v3 base score: 5.3
Published: 2022-08-15T11:21Z
Repository: https://github.com/nodejs/undici
Language: JavaScript
Files changed: lib/core/request.js, test/request-crlf.js
Commit date: 2022-08-09 11:32:40 +0200
Commit message: Merge pull request from GHSA-f772-66g8-q5h3


Diff: diff --git a/lib/core/request.js b/lib/core/request.js
index 4dc2fcc..b05a16d 100644
--- a/lib/core/request.js
+++ b/lib/core/request.js
@@ -295,11 +295,12 @@ function processHeader (request, key, val) {
       throw new InvalidArgumentError('invalid content-length header')
     }
   } else if (
     request.contentType === null &&
     key.length === 12 &&
-    key.toLowerCase() === 'content-type'
+    key.toLowerCase() === 'content-type' &&
+    headerCharRegex.exec(val) === null
   ) {
     request.contentType = val
     request.headers += `${key}: ${val}\r\n`
   } else if (
     key.length === 17 &&
diff --git a/test/request-crlf.js b/test/request-crlf.js
new file mode 100644
index 0000000..a01602a
--- /dev/null
+++ b/test/request-crlf.js
@@ -0,0 +1,32 @@
+'use strict'
+
+const { createServer } = require('http')
+const { test } = require('tap')
+const { request, errors } = require('..')
+
+test('should validate content-type CRLF Injection', (t) => {
+  t.plan(2)
+
+  const server = createServer((req, res) => {
+    t.fail('should not receive any request')
+    res.statusCode = 200
+    res.end('hello')
+  })
+
+  t.teardown(server.close.bind(server))
+
+  server.listen(0, async () => {
+    try {
+      await request(`http://localhost:${server.address().port}`, {
+        method: 'GET',
+        headers: {
+          'content-type': 'application/json\r\n\r\nGET /foo2 HTTP/1.1'
+        },
+      })
+      t.fail('request should fail')
+    } catch (e) {
+      t.type(e, errors.InvalidArgumentError)
+      t.equal(e.message, 'invalid content-type header')
+    }
+  })
+})

Vulnerable code:     key.toLowerCase() === 'content-type'
Fixed code:     key.toLowerCase() === 'content-type' &&
    headerCharRegex.exec(val) === null
'use strict'

const { createServer } = require('http')
const { test } = require('tap')
const { request, errors } = require('..')

test('should validate content-type CRLF Injection', (t) => {
  t.plan(2)

  const server = createServer((req, res) => {
    t.fail('should not receive any request')
    res.statusCode = 200
    res.end('hello')
  })

  t.teardown(server.close.bind(server))

  server.listen(0, async () => {
    try {
      await request(`http://localhost:${server.address().port}`, {
        method: 'GET',
        headers: {
          'content-type': 'application/json\r\n\r\nGET /foo2 HTTP/1.1'
        },
      })
      t.fail('request should fail')
    } catch (e) {
      t.type(e, errors.InvalidArgumentError)
      t.equal(e.message, 'invalid content-type header')
    }
  })
})