Listen to this Post
How the CVE Works:
This vulnerability arises in NestJS applications utilizing the `@nestjs/platform-fastify` adapter when security middleware (e.g., for authentication) is bound to routes using string paths. The Fastify adapter normalizes incoming request URLs for routing but may not apply the same normalization when matching against middleware path patterns. An attacker can craft a request with URL-encoded characters (e.g., `%61` for ‘a’) in the path. The application’s router, after normalization, correctly resolves this to the intended endpoint (e.g., /admin). However, the path-based middleware matcher fails to recognize the encoded path as a match for its configured string pattern ('admin'). Consequently, the security middleware is bypassed, granting unauthorized access to the protected route handler, leading to authentication and authorization failures.
dailycve form:
Platform: NestJS Fastify
Version: < 11.1.11
Vulnerability : Path Middleware Bypass
Severity: Critical
date: 2024-03-26
Prediction: Patched 2024-03-26
What Undercode Say:
npm list @nestjs/platform-fastify
npm update @nestjs/[email protected]
// Vulnerable configuration
consumer.apply(AuthMiddleware).forRoutes('admin');
// Safer alternative using RouteInfo objects
consumer.apply(AuthMiddleware).forRoutes({ path: 'admin', method: RequestMethod.ALL });
How Exploit:
Request: GET /%61dmin Bypasses: AuthMiddleware Accesses: /admin controller
Protection from this CVE
Update to `@nestjs/platform-fastify` version 11.1.11 or later. Use `RouteInfo` objects (with defined `path` and method) instead of string paths when applying middleware via MiddlewareConsumer. Implement security checks at the controller/guard level as a secondary layer.
Impact:
Authentication Bypass
Authorization Bypass
Validation Bypass
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
