Fastify: Incorrect Content-Type parsing can lead to CSRF attack
Published 21 Nov 2022 · Updated 8 Nov 2023
Affected packages
- Affected
- >=4.0.0 <4.10.2
- Fixed in
- 4.10.2
npm install fastify@4.10.2- Affected
- >=3.0.0 <3.29.4
- Fixed in
- 3.29.4
npm install fastify@3.29.4Details
Impact
The attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.
Patches
For 4.x users, please update to at least 4.10.2
For 3.x users, please update to at least 3.29.4
Workarounds
Implement Cross-Site Request Forgery protection using `@fastify/csrf`.
References
Check out the HackerOne report: https://hackerone.com/reports/1763832.
For more information
Is GHSA-3fjj-p79j-c9hh in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected fastify, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.