GitHub Advisoryadvisory · npm

GHSA-v2v2-hph8-q5xp @fastify/reply-from JSON Content-Type parsing confusion

MEDIUM Published 2024-01-08 Modified 2024-01-08 Official page ↗
Aliases
CVE-2023-51701
Ecosystem
npm
Packages
@fastify/reply-from
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-444
Reviewed
2024-01-08

Affected packages

• npm @fastify/reply-from: < 9.6.0 → fixed in 9.6.0

Description

Impact The main repo of fastify use fast-content-type-parse to parse request Content-Type, which will trim after split. The fastify-reply-from have not use this repo to unify the parse of Content-Type, which won't trim. As a result, a reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. Patches `@fastify/reply-from` v9.6.0 include the fix. Workarounds There are no known workarounds. References Hackerone Report: https://hackerone.com/reports/2295770.

Related

Alias · CVE (1)

  • CVE-2023-51701 fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References