CVE-2023-51701: @fastify/reply-from JSON Content-Type parsing confusion
Summary
CVE-2023-51701: @fastify/reply-from JSON Content-Type parsing confusion. Affects @fastify/reply-from versions < 9.6.0. Fixed in 9.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @fastify/reply-from package is an npm package used for building reverse proxy servers. It is a dependency of the main fastify repository and is responsible for parsing the Content-Type header of incoming requests. However, there is a vulnerability in the package's JSON Content-Type parsing logic, which can lead to a bypass of security checks.
Vulnerability Detail
The vulnerability arises from a discrepancy in the parsing of the Content-Type header between the main fastify repository and the @fastify/reply-from package. While the main repository uses fast-content-type-parse, which trims the Content-Type value after splitting, the reply-from package does not use this logic and does not trim the value. This discrepancy allows a reverse proxy server built with @fastify/reply-from to misinterpret the incoming body if the Content-Type header contains extra whitespace. An attacker can exploit this vulnerability by sending a request with a header like 'ContentType: application/json ; charset=utf-8', bypassing security checks that rely on proper Content-Type parsing.
How To Fix
Minimum fixed version
9.6.0
This is the first release that contains the fix.
npm install @fastify/reply-from@9.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability.
Conclusion
The @fastify/reply-from package is vulnerable to a JSON Content-Type parsing confusion issue, which can be exploited to bypass security checks. To mitigate this vulnerability, it is recommended to update the package to version 9.6.0 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @fastify/reply-from →
FAQ
The vulnerability allows an attacker to bypass security checks by sending requests with manipulated Content-Type headers. This can potentially lead to the execution of unauthorized actions or the exposure of sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will analyze it for any known vulnerabilities, including this one.
There are currently no known public exploits for this vulnerability. However, it is important to update the @fastify/reply-from package to the latest version to mitigate the risk.
Yes, you can refer to the HackerOne report (https://hackerone.com/reports/2295770) for more details about the discovery and disclosure of this vulnerability.
No, the vulnerability is specific to the @fastify/reply-from package. Updating this package to version 9.6.0 or later is sufficient to address the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for @fastify/reply-from.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
