GitHub Advisoryadvisory · npm

GHSA-c4qr-gmr9-v23w Prefix escape

LOW Published 2021-03-03 Modified 2021-03-02 Official page ↗
Aliases
CVE-2021-21322
Ecosystem
npm
Packages
fastify-http-proxy
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-20
Reviewed
2021-03-02

Affected packages

• npm fastify-http-proxy: < 4.3.1 → fixed in 4.3.1

Description

Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Patches All releases after v4.3.1 include the fix. Workarounds There are no workaround available. For more information If you have any questions or comments about this advisory: • Open an issue in fastify-reply-from • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-21322 fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References