Listen to this Post
How the mentioned CVE works:
The `@fastify/reply-from` plugin allows a Fastify server to forward specific HTTP requests to a designated upstream URL. It uses a `reply.from()` method configured for particular routes. The vulnerability is a path traversal bypass within the route matching logic. When the plugin is configured to protect a third-party resource by forwarding only whitelisted routes, an attacker can circumvent this restriction. By crafting a request where the path contains URL-encoded dot-dot sequences (%2e%2e or `%2E%2E` representing ..), the attacker can manipulate the path resolution. The plugin’s route matcher fails to normalize or correctly interpret these encoded sequences before checking against the allowed list. Consequently, a request to a forbidden path like `/protected/../admin` is sent to the upstream server as /admin, successfully bypassing the intended route filter and accessing unauthorized endpoints.
DailyCVE Form:
Platform: Fastify-reply-from plugin
Version: Not specified
Vulnerability: Route bypass
Severity: Moderate
date: 2024-12-02
Prediction: 2024-12-05
What Undercode Say:
Bash commands and codes related to the blog
curl -H "Host: vulnerable-app.com" "http://target/protected-path/%2e%2e/admin-api"
// Example vulnerable route configuration
fastify.register(require('@fastify/reply-from'), {
base: 'http://upstream.internal',
undici: true
});
fastify.get('/allowed-route/', (request, reply) => {
reply.from('/allowed-route/' + request.params['']); // Bypass possible here
});
How Exploit:
Craft HTTP request with encoded `..` (%2e%2e) in path to traverse out of allowed route prefix and access arbitrary upstream endpoints.
Protection from this CVE:
Update plugin version. Implement strict input validation and path normalization before route matching. Use allow-lists for upstream paths.
Impact:
Unauthorized access to protected upstream routes and internal admin APIs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
