PT-2021-11545 · Unknown · Fastify-Csrf
Matteo Collina
·
Published
2021-01-19
·
Updated
2021-01-27
·
CVE-2020-28482
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
fastify-csrf versions prior to 3.0.0
Description:
The issue affects the fastify-csrf package, where the generated cookie uses insecure defaults and lacks the httpOnly flag, as seen in
cookieOpts: { path: '/', sameSite: true }. Additionally, the CSRF token is available in the GET query parameter. This set of issues compromises the package's ability to provide CSRF protection.Recommendations:
For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue. As a temporary workaround, consider setting the httpOnly flag on the cookie and restricting access to the CSRF token in the GET query parameter.
Fix
Information Disclosure
Incorrect Permission
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fastify-Csrf