GHSA-c4qr-gmr9-v23wLowCVSS 10.0

Prefix escape

Published
March 3, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-21322 →

📋 Description

Impact

By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Patches

All releases after v4.3.1 include the fix.

Workarounds

There are no workaround available.

For more information

If you have any questions or comments about this advisory:

🎯 Affected products1

  • npm/fastify-http-proxy:< 4.3.1

🔗 References (5)