En bref
- CVE-2021-21322 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant fastify-http-proxy (fastify-http-proxy project), fastify-http-proxy.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.6%, plus élevée que 76.3% des vulnérabilités.
- Correctif : mettre à jour vers 4.3.1 ou plus récent.
Description
Impact
By crafting a specific URL, it is possible to escape the prefix of the proxied backend service.
If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Patches
All releases after v4.3.1 include the fix.
Workarounds
There are no workaround available.
For more information
If you have any questions or comments about this advisory:
NVD description
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free