Vulnerability · Published Mar 2, 2021 · Assigned by GitHub_M
CVE-2021-21321Prefix escape
Critical 10.0
In plain English
A critical-severity improper input validation in fastify-reply-from from fastify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | fastify-reply-from | 4.0.2 | GHSA-qmw8-3v4g-gwj4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| fastify | fastify-reply-from | < 4.0.2 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N