CVE-2021-21321: Prefix escape
A flaw was found in fastify-reply-from. Escaping of the prefix of the proxied backend service is possible allowing an attacker, using a specially crafted URL, to gain access to directories that would otherwise be out of bounds. The highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21321?
CVE-2021-21321 is rated as a high severity vulnerability due to its potential to expose sensitive files and directories.
How do I fix CVE-2021-21321?
To fix CVE-2021-21321, upgrade the fastify-reply-from package to version 4.0.2 or later.
What software is affected by CVE-2021-21321?
CVE-2021-21321 affects the fastify-reply-from package specifically versions prior to 4.0.2.
What impact does CVE-2021-21321 have on my system?
CVE-2021-21321 allows attackers to exploit improperly handled URL prefixes to access restricted directories.
Is CVE-2021-21321 exploitable remotely?
Yes, CVE-2021-21321 can be exploited remotely using specially crafted URLs.