CVE-2021-29624
Lack of protection against cookie tossing attacks in fastify-csrf
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.
fastify-csrf es un plugin de código abierto que ayuda a desarrolladores a proteger su servidor Fastify contra ataques de tipo CSRF. Las versiones de fastify-csrf anterior a versión 3.1.0, presentan un mecanismo de "double submit" usando cookies con una aplicación implementada en múltiples subdominios, por ejemplo, una plataforma de estilo "heroku" como servicio. La versión 3.1.0 de fastify-csrf corrige la vulnerabilidad. El usuario del módulo necesitaría suministrar un "userInfo" cuando se genera el token de tipo CSRF para implementar completamente la protección en su extremo. Esto solo es necesario para aplicaciones alojadas en diferentes subdominios
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-03-30 CVE Reserved
- 2021-05-19 CVE Published
- 2023-12-24 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
- CWE-565: Reliance on Cookies without Validation and Integrity Checking
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html | Third Party Advisory | |
| https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0 | Third Party Advisory | |
| https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/fastify/csrf/pull/2 | 2022-10-25 | |
| https://github.com/fastify/fastify-csrf/pull/51 | 2022-10-25 | |
| https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8 | 2022-10-25 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Fastify Search vendor "Fastify" | Fastify-csrf Search vendor "Fastify" for product "Fastify-csrf" | < 3.1.0 Search vendor "Fastify" for product "Fastify-csrf" and version " < 3.1.0" | node.js |
Affected
| ||||||