FlawOpen

flawopen.com/Teardowns/cve-2022-31150-undici-crlf-injection

● CVE-2022-31150 · CVSS 5.3 · Medium
FlawOpen Security Research

CVE-2022-31150: Undici CRLF Injection

CVE-2022-31150 let untrusted CR/LF reach Undici request serialization. See the upstream validation fix and safe upgrade guidance.

💡 Plain English Explainer (ELI5)

An HTTP request is like a form with strict line breaks: each line has one field. If a clerk copies unchecked text onto the form, a hidden line break can make the following text look like a new field. Undici’s fix checks header values, method tokens, and request paths before writing them.

Core Concepts & Subsystem Terms

Undici
The Node.js HTTP/1.1 client library; Node.js also bundles an Undici implementation for built-in fetch.
CRLF injection
Untrusted carriage-return and line-feed bytes enter a protocol field where they can change line boundaries.
HTTP token
The restricted character set used for protocol tokens such as header names and methods.
Request target
The path and query sent with an HTTP request; control characters must not be allowed to alter its framing.

Framework mappings

  • CWE reference for the weakness described in this guide: CWE-93

Root Cause Analysis

Before the fix, Undici could serialize attacker-influenced header values containing invalid control characters into the HTTP request. CR/LF are line delimiters, so accepting them can inject or corrupt header lines. The upstream patch validates header names as HTTP tokens, rejects invalid header-value characters, validates the method token, and rejects control characters in the path. The GitHub advisory lists affected package versions as <5.8.0, while NVD’s description says <5.7.1; both identify 5.8.0 as fixed. This is request injection in the client library; SSRF or credential exposure is not an automatic consequence and depends on the calling application and network path.

Step-by-Step Attack Flow

Step 1

1. Untrusted value

Application data reaches an Undici header, method, or path parameter.

Step 2

2. Missing validation

In affected versions, invalid control characters could pass into request construction.

Step 3

3. Protocol boundary

HTTP serialization uses line boundaries; accepting control characters can inject or corrupt request fields.

Step 4

4. Patch and containment

Undici 5.8.0 validates header bytes, method tokens, and path characters before serialization; application impact depends on context.

Source Code: Flaw vs. Secure Implementation

UNPATCHED FLAW
// Relevant serialization sink in lib/core/request.js before a29a151
function serializeRequest(request, method, path, headers) {
  request.method = method;
  request.path = path;
  for (const [key, value] of Object.entries(headers)) {
    // No protocol-character validation before serialization.
    request.headers += `${key}: ${value}\r\n`;
  }
}
HARDENED SECURE PATCH
// Hardened validation pattern from the upstream request parser
const token = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
const invalidFieldValue = /[^\t\x20-\x7e\x80-\xff]/;
const invalidPath = /[^\u0021-\u00ff]/;

function validateRequestTarget(method, path) {
  if (!token.test(method)) throw new InvalidArgumentError('invalid request method');
  if (invalidPath.test(path)) throw new InvalidArgumentError('invalid request path');
}

function processHeader(request, key, value) {
  if (!token.test(key)) throw new InvalidArgumentError('invalid header key');
  if (invalidFieldValue.test(value)) throw new InvalidArgumentError(`invalid ${key} header`);
  request.headers += `${key}: ${value}\r\n`;
}

Engineering & System Hardening Checklist

Sources