PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-24758 nodejs CVE debrief

CVE-2024-24758 describes an information disclosure vulnerability in Undici, an HTTP/1.1 client for Node.js. While Undici properly clears Authorization headers during cross-origin redirects, it fails to clear Proxy-Authentication headers, potentially exposing proxy credentials to unintended destinations. This vulnerability affects Siemens SINEC INS, which incorporates the vulnerable Undici component. The issue was published on November 12, 2024, with patches available in Undici versions 5.28.3 and 6.6.1. Siemens has released V1.0 SP2 Update 3 to address this in their product. The CVSS 3.1 score of 3.9 (Low severity) reflects the attack complexity requirements: network access with high attack complexity, high privileges required, and user interaction needed. No known workarounds exist; patching is the only remediation. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
nodejs
Product
SINEC INS
CVSS
LOW 3.9
CISA KEV
Not listed in stored evidence
Original CVE published
2024-11-12
Original CVE updated
2024-11-12
Advisory published
2024-11-12
Advisory updated
2024-11-12

Who should care

Organizations operating Siemens SINEC INS for industrial network management, particularly those in critical infrastructure sectors. Node.js developers using Undici as an HTTP client, especially in applications handling sensitive proxy authentication. Security teams responsible for ICS/OT environments where credential exposure could facilitate lateral movement or unauthorized network access.

Technical summary

The Undici HTTP/1.1 client for Node.js contains an information disclosure vulnerability where Proxy-Authentication headers are not cleared during cross-origin redirects, unlike Authorization headers which are properly handled. This behavior could allow proxy credentials to be transmitted to unintended third-party servers when following redirects. The vulnerability exists in the request handling logic of Undici's redirect implementation. Siemens SINEC INS, an industrial network management system, incorporates the vulnerable Undici component and is affected by this issue. The attack requires an attacker to control or influence a server that returns a cross-origin redirect response, combined with social engineering or other means to cause a user or application to initiate a request with proxy authentication credentials to that attacker-controlled server.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Siemens SINEC INS to V1.0 SP2 Update 3 or later version
  • Review proxy authentication configurations in affected environments
  • Monitor for unauthorized proxy access attempts
  • Apply principle of least privilege for proxy credentials
  • Validate Undici dependency versions in Node.js applications using SINEC INS

Evidence notes

Vulnerability description and affected product information sourced from CISA CSAF advisory ICSA-24-319-08. Patch versions and remediation guidance confirmed through Siemens security advisory SSA-915275. CVSS vector and scoring details extracted from source metadata. Timeline dates derived from CVE record and CSAF publication metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-24758 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-24758

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-24758 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-24758

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-319-08.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-915275.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-915275.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-08

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.