Описание
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
A NestJS application is vulnerable if it meets all of the following criteria:
- Platform: Uses
@nestjs/platform-fastify. - Security Mechanism: Relies on
NestMiddleware(viaMiddlewareConsumer) for security checks (authentication, authorization, etc.), or throughapp.use() - Routing: Applies middleware to specific routes using string paths or controllers (e.g.,
.forRoutes('admin')). Example Vulnerable Config:
Attack Vector:
- Target Route:
/admin - Middleware Path:
admin - Attack Request:
GET /%61dmin - Result: Middleware is skipped (no match on
%61dmin), but controller for/adminis executed.
Consequences:
- Authentication Bypass: Unauthenticated users can access protected routes.
- Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.
- Input Validation Bypass: Middleware performing sanitization or validation can be skipped.
Patches
Patched in @nestjs/platform-fastify@11.1.11
Resources
Credit goes to Hacktron AI for reporting this issue.
Пакеты
@nestjs/platform-fastify
< 11.1.10
11.1.11
Связанные уязвимости
Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in `@nestjs/platform-fastify@11.1.11`.