PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-45143 nodejs CVE debrief

CVE-2023-45143 is a LOW-severity vulnerability (CVSS 3.9) affecting Undici, an HTTP/1.1 client for Node.js. The issue involves improper handling of Cookie headers during cross-origin redirects. Prior to version 5.26.2, Undici cleared Authorization headers on cross-origin redirects but failed to clear Cookie headers. While browsers forbid Cookie headers in RequestInit.headers per the Fetch specification, Undici's more liberal header handling created a disconnect that could lead to accidental cookie leakage to third-party sites or malicious actors controlling redirect targets. Siemens SINEC INS is affected by this vulnerability through its use of the vulnerable Undici component. The vulnerability was published on November 12, 2024, and affects SINEC INS prior to V1.0 SP2 Update 3.

Vendor
nodejs
Product
SINEC INS
CVSS
LOW 3.9
CISA KEV
Not listed in stored evidence
Original CVE published
2024-11-12
Original CVE updated
2024-11-12
Advisory published
2024-11-12
Advisory updated
2024-11-12

Who should care

Organizations running Siemens SINEC INS industrial network management software, particularly those with externally accessible interfaces or complex redirect chains. OT security teams managing industrial control systems should prioritize this update as part of routine patch management. Node.js developers using Undici directly should also verify their dependency versions.

Technical summary

The vulnerability exists in Undici's fetch implementation, which handles headers more liberally than the Fetch specification allows. While browsers prevent Cookie headers from being set in RequestInit.headers, Undici permits this. During cross-origin redirects, Undici properly strips Authorization headers but retains Cookie headers, violating the expected security boundary. An attacker who can control a redirect destination (via open redirector or compromised endpoint) could receive cookies intended for the original origin. The attack requires high privileges, user interaction, and high attack complexity, limiting practical exploitability.

Defensive priority

medium

Recommended defensive actions

  • Update Siemens SINEC INS to V1.0 SP2 Update 3 or later version
  • Review application configurations for any custom redirect handling that may compound the issue
  • Monitor for suspicious cross-origin redirect patterns in application logs
  • Apply defense-in-depth strategies for industrial control systems as recommended by CISA
  • Verify that Node.js dependencies are updated to Undici 5.26.2 or later in custom deployments

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-24-319-08, which references Siemens security advisory SSA-915275. The CVSS score of 3.9 reflects the attack complexity requirements (user interaction, high privileges, high attack complexity) that limit exploitability.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-45143 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-45143

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-45143 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-45143

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-319-08.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-915275.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-915275.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-08

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.