CVE-2021-21321: fastify-reply-from - Prefix escape
Summary
CVE-2021-21321: Prefix escape. Affects fastify-reply-from versions < 4.0.2. Fixed in 4.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fastify-reply-from is an npm package that provides a proxy reply plugin for the Fastify framework. It allows Fastify to proxy requests to another server and send back the response. This package is commonly used in web applications to handle proxying of backend services. However, a vulnerability has been discovered in versions prior to v4.0.2 that allows an attacker to escape the prefix of the proxied backend service.
Vulnerability Detail
The vulnerability arises from a flaw in the URL handling of fastify-reply-from. By crafting a specific URL, an attacker can bypass the expected prefix of the proxied backend service. For example, if the base URL of the proxied server is '/pub/', a user would expect that accessing '/priv' on the target service would not be possible. However, due to this vulnerability, it is possible to access '/priv' and other paths that should be restricted. This can lead to unauthorized access to sensitive information or functionality on the target server. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 10.0, indicating its critical severity.
How To Fix
Minimum fixed version
4.0.2
This is the first release that contains the fix.
npm install fastify-reply-from@4.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds available for this vulnerability. It is essential to update the package to the fixed version as soon as possible.
Conclusion
The fastify-reply-from package prior to version 4.0.2 is vulnerable to a prefix escape flaw, allowing unauthorized access to the proxied backend service. It is crucial to update the package to version 4.0.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fastify-reply-from →
FAQ
fastify-reply-from is an npm package that provides a proxy reply plugin for the Fastify framework. It allows Fastify to proxy requests to another server and send back the response.
The vulnerability allows an attacker to bypass the prefix of the proxied backend service, potentially gaining unauthorized access to sensitive information or functionality on the target server.
To fix this vulnerability, update fastify-reply-from to version 4.0.2 or later by running 'npm update fastify-reply-from' in the terminal.
No, there are no known workarounds for this vulnerability. Updating the package to the fixed version is the recommended solution.
The severity of this vulnerability is critical, with a CVSS score of 10.0.
