Lucene search
AnonymousNODEJS:1642HistoryMar 03, 2021 - 1:55 a.m.
Prefix escape
2021-03-0301:55:12
Anonymous
www.npmjs.com
23
fastify-reply-from
prefix escape
upgrade
cve-2021-21321
security advisory
EPSS
0.003
Percentile
70.7%
Overview
In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service.
If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is.
Recommendation
Upgrade to version 4.0.2
References
Related
github
github
Prefix escape
2021-03-03 01:52:05
osv
osv
Prefix escape
2021-03-03 01:52:05
CVE-2021-21321
2021-03-02 04:15:12
prion
prion
Design/Logic Flaw
2021-03-02 04:15:00
nvd
nvd
CVE-2021-21321
2021-03-02 04:15:12
cvelist
cvelist
CVE-2021-21321 Prefix escape
2021-03-02 03:35:25
redhatcve
redhatcve
CVE-2021-21321
2021-03-23 20:37:26
veracode
veracode
Authorization Bypass
2021-03-03 06:00:07
cve
cve
CVE-2021-21321
2021-03-02 04:15:12
redhat
redhat