fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2.
References
Link | Resource |
---|---|
https://github.com/fastify/fastify-reply-from/commit/dea227dda606900cc01870d08541b4dcc69d3889 | Patch Third Party Advisory |
https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-qmw8-3v4g-gwj4 | Third Party Advisory |
https://www.npmjs.com/package/fastify-reply-from | Product Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
09 Mar 2021, 13:43
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:fastify-reply-from_project:fastify-reply-from:*:*:*:*:*:node.js:*:* | |
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 10.0 |
References | (MISC) https://github.com/fastify/fastify-reply-from/commit/dea227dda606900cc01870d08541b4dcc69d3889 - Patch, Third Party Advisory | |
References | (CONFIRM) https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-qmw8-3v4g-gwj4 - Third Party Advisory | |
References | (MISC) https://www.npmjs.com/package/fastify-reply-from - Product, Third Party Advisory |
02 Mar 2021, 04:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-03-02 04:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-21321
Mitre link : CVE-2021-21321
CVE.ORG link : CVE-2021-21321
JSON object : View
Products Affected
fastify-reply-from_project
- fastify-reply-from
CWE
CWE-20
Improper Input Validation