PT-2023-21170 · Npm · @Fastify/Csrf-Protection

Pedromigueladao · Published 2023-04-20 · Updated 2023-05-02 · CVE-2023-27495

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions @fastify/csrf-protection versions prior to 4.1.0 @fastify/csrf-protection versions prior to 6.3.0

Description The CSRF protection mechanism in the @fastify/csrf-protection library can be bypassed by network and same-site attackers under certain conditions, allowing them to fixate a csrf cookie in the victim's browser and forge valid CSRF tokens. This is possible when the userInfo parameter is missing or its value can be predicted for the target user account. The issue can be exploited by attackers to bypass the CSRF protection.

Recommendations For versions prior to 4.1.0, upgrade to version 4.1.0 or later. For versions prior to 6.3.0, upgrade to version 6.3.0 or later. As a temporary mitigation for users unable to upgrade, use a random, non-predictable userInfo parameter for each user.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-27495

GHSA-QRGF-9GPC-VRXW

Affected Products

@Fastify/Csrf-Protection

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27495.json · Exploit
• https://github.com/fastify/csrf-protection/security/advisories/GHSA-qrgf-9gpc-vrxw · Vendor Advisory
• https://github.com/fastify/csrf-protection/commit/be3e5761f37aa05c7c1ac8ed44499c51ecec8058 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-27495 · Security Note
• https://osv.dev/vulnerability/GHSA-qrgf-9gpc-vrxw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27495 · Vendor Advisory
• https://github.com/fastify/csrf-protection/releases/tag/v4.1.0 · Note
• https://github.com/fastify/csrf-protection/security/advisories/GHSA-rc4q-9m69-gqp8 · Note
• https://github.com/fastify/csrf-protection/releases/tag/v6.3.0 · Note
• https://github.com/fastify/csrf-protection · Note
• https://t.me/cibsecurity/62548 · Telegram Post
• https://cvedetails.com/cve/CVE-2021-29624 · Note
• https://t.me/cvenotify/49585 · Telegram Post