GitHub Advisoryadvisory · npm

GHSA-qmw8-3v4g-gwj4 Prefix escape

CRITICAL Published 2021-03-03 Modified 2021-03-02 Official page ↗
Aliases
CVE-2021-21321
Ecosystem
npm
Packages
fastify-reply-from
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-20
Reviewed
2021-03-02

Affected packages

• npm fastify-reply-from: < 4.0.2 → fixed in 4.0.2

Description

Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Patches A patch have been submitted by Corey Farrell [email protected], the reporter. All releases after v4.0.2 include the fix. Workarounds There are no workaround available. For more information If you have any questions or comments about this advisory: • Open an issue in fastify-reply-from • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-21321 fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References