CVE-2021-29624: Vulnerability in fastify-csrf
Summary
CVE-2021-29624: Lack of protection against cookie tossing attacks in fastify-csrf. Affects fastify-csrf versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fastify-csrf is an npm package that provides Cross-Site Request Forgery (CSRF) protection for Fastify applications. It is designed to prevent CSRF attacks by generating and validating tokens. However, prior to version 3.1.0, fastify-csrf lacked protection against cookie tossing attacks when used with the "double submit" mechanism across multiple subdomains. This vulnerability could potentially allow attackers to bypass CSRF protection and perform unauthorized actions on behalf of users.
Vulnerability Detail
The vulnerability in fastify-csrf arises from the lack of protection against cookie tossing attacks. When using the "double submit" mechanism with cookies across multiple subdomains, the CSRF protection provided by fastify-csrf can be bypassed. This can lead to unauthorized actions being performed by attackers on behalf of users. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.1.0
This is the first release that contains the fix.
npm install fastify-csrf@3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to update fastify-csrf to the patched version to mitigate the risk of cookie tossing attacks.
Conclusion
The vulnerability in fastify-csrf can be mitigated by updating to version 3.1.0 or later. It is crucial to apply this patch to prevent cookie tossing attacks and ensure the proper functioning of CSRF protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fastify-csrf →
FAQ
fastify-csrf is an npm package that provides Cross-Site Request Forgery (CSRF) protection for Fastify applications. It generates and validates tokens to prevent CSRF attacks.
A cookie tossing attack is a type of CSRF attack where an attacker can manipulate or steal cookies to bypass CSRF protection mechanisms.
The "double submit" mechanism is a CSRF protection technique where a CSRF token is included both in a cookie and as a request parameter. The server compares the values to validate the request.
To update fastify-csrf, run the following command in your project directory: npm update fastify-csrf
Yes, after updating to version 3.1.0 or later, users of fastify-csrf need to supply a userInfo when generating the CSRF token to fully implement the protection, especially for applications hosted on different subdomains.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify-csrf.
