요약
- CVE-2025-69211은(는) nest (nestjs), @nestjs/platform-fastify에 영향을 주는 높음 (CVSS 7.4) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.38%, 전체 취약점의 32.2%보다 높음.
- 조치: 11.1.11 이상으로 업데이트하세요.
Description
A NestJS application is vulnerable if it meets all of the following criteria:
- Platform: Uses
@nestjs/platform-fastify.
- Security Mechanism: Relies on
NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use()
- Routing: Applies middleware to specific routes using string paths or controllers (e.g.,
.forRoutes('admin')).
Example Vulnerable Config:
// app.module.ts
export class AppModule implements NestModule {
configure(consumer: MiddlewareConsumer) {
consumer
.apply(AuthMiddleware) // Security check
.forRoutes('admin'); // Vulnerable: Path-based restriction
}
}
Attack Vector:
- Target Route:
/admin
- Middleware Path:
admin
- Attack Request:
GET /%61dmin
- Result: Middleware is skipped (no match on
%61dmin), but controller for /admin is executed.
Consequences:
- Authentication Bypass: Unauthenticated users can access protected routes.
- Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.
- Input Validation Bypass: Middleware performing sanitization or validation can be skipped.
Patches
Patched in @nestjs/[email protected]
Resources
Credit goes to Hacktron AI for reporting this issue.
NVD description
Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in `@nestjs/[email protected]`.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free