CVE-2021-21321 Prefix escape
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2021-21321?
CVE-2021-21321 is a critical vulnerability in fastify-reply-from, published on 2 Mar 2021.
Official description
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2.
Weakness: CWE-20
Which versions are affected by CVE-2021-21321?
2 open source packages ship an affected version, including fastify-reply-from. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fastify-reply-from npm | All versions | 4.0.2 |
fastify-reply-from npm | All versions | 4.0.2 |
Products include Fastify-Reply-From Project Fastify-Reply-From.
How do I fix CVE-2021-21321?
Upgrade fastify-reply-from to 4.0.2 or later.
Is CVE-2021-21321 being exploited?
There is no known exploitation of CVE-2021-21321 in the wild and no public exploit code.
Sources
Also known as GHSA-qmw8-3v4g-gwj4.