PT-2024-14252 · Fastify · @Fastify/Reply-From

Qwerty472123 · Published 2024-01-08 · Updated 2024-01-12 · CVE-2023-51701

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions @fastify/reply-from versions prior to 9.6.0

Description The issue arises when a reverse proxy server built with @fastify/reply-from misinterprets the incoming body by passing a header ContentType: application/json ; charset=utf-8, potentially leading to the bypass of security checks. This occurs because @fastify/reply-from does not unify the parsing of Content-Type with the main Fastify repository, which uses fast-content-type-parse to trim after splitting. As a result, the lack of trimming in @fastify/reply-from can cause misinterpretation.

Recommendations For versions prior to 9.6.0, update to version 9.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the @fastify/reply-from plugin until the update can be applied. Additionally, avoid using the ContentType header with the application/json ; charset=utf-8 value in the affected API endpoints until the issue is resolved.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2023-51701

GHSA-V2V2-HPH8-Q5XP

Affected Products

@Fastify/Reply-From

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51701.json · Exploit
• https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v2v2-hph8-q5xp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v2v2-hph8-q5xp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51701 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51701 · Vendor Advisory
• https://github.com/fastify/fastify-reply-from · Note
• https://github.com/fastify/fastify-reply-from/commit/cbd7c17c09e6476268e34f5e499a6b923e8acc18 · Note
• https://github.com/fastify/fastify-reply-from/releases/tag/v9.6.0 · Note
• https://t.me/cvenotify/66596 · Telegram Post
• https://twitter.com/cracbot/status/1745899722861404669 · Twitter Post
• https://t.me/cvenotify/66614 · Telegram Post