En resumen
- CVE-2021-21322 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a fastify-http-proxy (fastify-http-proxy project), fastify-http-proxy.
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.6%, mayor que el 76.3% de las vulnerabilidades.
- Solución: actualizar a 4.3.1 o posterior.
Description
Impact
By crafting a specific URL, it is possible to escape the prefix of the proxied backend service.
If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Patches
All releases after v4.3.1 include the fix.
Workarounds
There are no workaround available.
For more information
If you have any questions or comments about this advisory:
NVD description
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free