REDHAT-BUG-2015152: Medium severity fastify static vulnerability
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.
Reference: https://hackerone.com/reports/1354255
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2015152?
REDHAT-BUG-2015152 is classified as a medium severity vulnerability due to its potential to redirect users to malicious websites.
How do I fix REDHAT-BUG-2015152?
To mitigate REDHAT-BUG-2015152, upgrade the fastify-static module to version 4.2.4 or later.
Who is affected by REDHAT-BUG-2015152?
Users of fastify-static versions earlier than 4.2.4 are at risk of exploitation from REDHAT-BUG-2015152.
What kind of attacks can REDHAT-BUG-2015152 facilitate?
REDHAT-BUG-2015152 can enable attackers to redirect users to arbitrary websites, posing a phishing or malware risk.
Is there a known exploit for REDHAT-BUG-2015152?
Yes, there are reports and evidence indicating the exploitation of REDHAT-BUG-2015152 in the wild.