Описание
fastify-reply-from affected by bypass of reply forwarding
Summary
By crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from.
Details
An attacker can bypass the route defined by the @fastify/reply-from package by adding a .. symbol, which, for curl version 8.7.1, is %2e%2e.
Impact
Everyone is using this package with the routes option to protect a 3rd-party resource.
Пакеты
@fastify/reply-from
<= 12.4.0
12.5.0
Связанные уязвимости
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from. This vulnerability is fixed in 12.5.0.