PT-2021-18374 · Unknown · Fastify-Csrf

Xhelal Likaj · Published 2021-05-17 · Updated 2023-05-02 · CVE-2021-29624

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions fastify-csrf versions prior to 3.1.0

Description The issue affects applications using the fastify-csrf plugin with the "double submit" mechanism, particularly those deployed across multiple subdomains. To fully implement protection, users of the module must supply a userInfo when generating the CSRF token, which is necessary for applications hosted on different subdomains.

Recommendations For versions prior to 3.1.0, update to version 3.1.0 to fix the issue. As a temporary workaround, consider supplying a userInfo when generating the CSRF token to enhance protection, especially for applications hosted on different subdomains.

Fix

CSRF

Weakness Enumeration

CWE-565

CWE-352

Related Identifiers

CVE-2021-29624

GHSA-QRGF-9GPC-VRXW

GHSA-RC4Q-9M69-GQP8

Affected Products

Fastify-Csrf

References · 21

• https://github.com/fastify/fastify-csrf/pull/51 · Patch
• https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8 · Patch
• https://github.com/fastify/csrf/pull/2 · Patch
• https://osv.dev/vulnerability/CVE-2021-29624 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rc4q-9m69-gqp8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qrgf-9gpc-vrxw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29624 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-27495 · Security Note
• https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0 · Note
• https://github.com/fastify/csrf-protection/security/advisories/GHSA-qrgf-9gpc-vrxw · Note
• https://github.com/fastify/csrf-protection/releases/tag/v4.1.0 · Note
• https://github.com/fastify/csrf-protection/commit/be3e5761f37aa05c7c1ac8ed44499c51ecec8058 · Note
• https://github.com/fastify/csrf-protection · Note
• https://github.com/fastify/csrf-protection/security/advisories/GHSA-rc4q-9m69-gqp8 · Note
• https://github.com/fastify/csrf-protection/releases/tag/v6.3.0 · Note