Summary By crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from.

Details

An attacker can bypass the route defined by the @fastify/reply-from package by adding a .. symbol, which, for curl version 8.7.1, is %2e%2e.

Impact

Everyone is using this package with the routes option to protect a 3rd-party resource.

Impact

The main repo of fastify use fast-content-type-parse to parse request Content-Type, which will trim after split.

The fastify-reply-from have not use this repo to unify the parse of Content-Type, which won't trim.

As a result, a reverse proxy server built with @fastify/reply-from could misinterpret the incoming body by passing an header ContentType: application/json ; charset=utf-8. This can lead to bypass of security checks.

Patches

@fastify/reply-from v9.6.0 include the fix.

Workarounds

There are no known workarounds.

References

Hackerone Report: https://hackerone.com/reports/2295770.

A flaw was found in fastify-reply-from. Escaping of the prefix of the proxied backend service is possible allowing an attacker, using a specially crafted URL, to gain access to directories that would otherwise be out of bounds. The highest threat from this vulnerability is to data confidentiality and integrity.