CVE-2021-21322: fastify-http-proxy Prefix Escape
Summary
CVE-2021-21322: Prefix escape. Affects fastify-http-proxy versions < 4.3.1. Fixed in 4.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fastify-http-proxy is an npm package that provides a proxy plugin for the Fastify web framework. It allows users to easily create reverse proxies to forward HTTP requests to another server. The package is widely used in Node.js applications to handle proxying functionality. However, a vulnerability has been discovered in versions prior to 4.3.1 that allows an attacker to escape the prefix of the proxied backend service. This means that an attacker can access URLs on the target service that should be restricted by the proxy's base URL.
Vulnerability Detail
The vulnerability arises from a failure to properly enforce the prefix of the proxied backend service. By crafting a specific URL, an attacker can bypass the expected restrictions and access URLs that should be inaccessible. For example, if the base URL of the proxied server is '/pub/', a user would expect that accessing '/priv' on the target service would not be possible. However, due to this vulnerability, an attacker can access '/priv' and potentially gain unauthorized access to sensitive information or perform unauthorized actions. The impact of this vulnerability is rated as Critical (CVSS score: 10.0).
How To Fix
Minimum fixed version
4.3.1
This is the first release that contains the fix.
npm install fastify-http-proxy@4.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds available for this vulnerability. It is recommended to update the package to the latest version as soon as possible.
Conclusion
The fastify-http-proxy package prior to version 4.3.1 is vulnerable to a prefix escape vulnerability, which allows an attacker to bypass the expected restrictions of the proxy. This can lead to unauthorized access to sensitive information or unauthorized actions. It is crucial to update the package to version 4.3.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fastify-http-proxy →
FAQ
fastify-http-proxy is an npm package that provides a proxy plugin for the Fastify web framework. It allows users to easily create reverse proxies to forward HTTP requests to another server.
The impact of this vulnerability is rated as Critical (CVSS score: 10.0). It allows an attacker to bypass the expected restrictions of the proxy and potentially gain unauthorized access to sensitive information or perform unauthorized actions.
To fix this vulnerability, update the fastify-http-proxy package to version 4.3.1 or later. All releases after v4.3.1 include the necessary fix to properly enforce the prefix of the proxied backend service.
There are no known workarounds available for this vulnerability. It is recommended to update the package to the latest version as soon as possible.
For more information, you can open an issue in the fastify-reply-from GitHub repository or email hello@matteocollina.com.
