CVE-2021-21321
Summary
| CVE | CVE-2021-21321 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-03-02 04:15:00 UTC |
|---|
| Updated | 2021-03-09 13:43:00 UTC |
|---|
| Description | fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| fastify-reply-from - npm |
MISC |
www.npmjs.com |
Product, Third Party Advisory |
| Merge pull request from GHSA-qmw8-3v4g-gwj4 · fastify/fastify-reply-from@dea227d · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Prefix escape · Advisory · fastify/fastify-reply-from · GitHub |
CONFIRM |
github.com |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 982930 Nodejs (npm) Security Update for fastify-reply-from (GHSA-qmw8-3v4g-gwj4)
