Fastify: Incorrect Content-Type parsing can lead to CSRF attack
Affected releases · fastify
- 4.x4.0.0 – 4.10.1Fixed in 4.10.2
- 3.x3.0.0 – 3.29.3Fixed in 3.29.4
On 4.x, the newest line:
npm install fastify@4.10.2Not affected
5.0.0 – 5.12.7
39 releases, latest
Affected
4.0.0 – 4.10.1
22 releases
Fixed
4.10.2 – 4.29.1
39 releases
Affected
3.0.0 – 3.29.3
69 releases
Fixed
3.29.4 – 3.29.5
2 releases
Is your project affected?
Paste your package.json, or type the range you declare for fastify. It is read in your browser and sent nowhere.
What happens
Impact
The attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.
Patches
For 4.x users, please update to at least 4.10.2
For 3.x users, please update to at least 3.29.4
Workarounds
Implement Cross-Site Request Forgery protection using @fastify/csrf.
References
Check out the HackerOne report: hackerone.com/reports/1763832.
For more information