CVE-2024-30260: 
JavaScript vulnerability analysis and mitigation

Undici, an HTTP/1.1 client written for Node.js, contains a security vulnerability identified as CVE-2024-30260. The vulnerability exists because while Undici cleared Authorization and Proxy-Authorization headers for fetch(), it did not clear them for undici.request(). This vulnerability affects versions prior to 5.28.4 and versions 6.0.0 through 6.11.0 (GitHub Advisory).

The vulnerability is related to improper authorization handling during cross-origin redirects. The CVSS v3.1 base score is 3.9 (LOW) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L. The issue specifically involves the failure to clear sensitive authorization headers when performing cross-origin redirects using the undici.request() method, while the same headers were properly cleared for the fetch() method (NVD).

The vulnerability could potentially lead to unauthorized information disclosure as sensitive authorization headers might be exposed during cross-origin redirects when using undici.request(). This could result in the leakage of authentication credentials to unintended destinations (GitHub Advisory).

The vulnerability requires high attack complexity and high privileges, along with user interaction to be exploited. The attack vector is network-based, but the overall exploitability is considered low due to these requirements (GitHub Advisory).

The vulnerability has been patched in versions 5.28.4 and 6.11.1. Users are recommended to upgrade to these versions or later. As a workaround, users can either use the fetch() method instead of undici.request() or disable maxRedirections (GitHub Advisory).