fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.
References
Link | Resource |
---|---|
https://github.com/fastify/fastify-http-proxy/commit/02d9b43c770aa16bc44470edecfaeb7c17985016 | Patch Third Party Advisory |
https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-c4qr-gmr9-v23w | Third Party Advisory |
https://www.npmjs.com/package/fastify-http-proxy | Product Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Mar 2021, 16:38
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:fastify-http-proxy_project:fastify-http-proxy:*:*:*:*:*:node.js:*:* | |
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
References | (MISC) https://github.com/fastify/fastify-http-proxy/commit/02d9b43c770aa16bc44470edecfaeb7c17985016 - Patch, Third Party Advisory | |
References | (MISC) https://www.npmjs.com/package/fastify-http-proxy - Product, Third Party Advisory | |
References | (CONFIRM) https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-c4qr-gmr9-v23w - Third Party Advisory |
02 Mar 2021, 04:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-03-02 04:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-21322
Mitre link : CVE-2021-21322
CVE.ORG link : CVE-2021-21322
JSON object : View
Products Affected
fastify-http-proxy_project
- fastify-http-proxy
CWE
CWE-20
Improper Input Validation