CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
49.6%
The attacker can use the incorrect Content-Type
to bypass the Pre-Flight
checking of fetch
. fetch()
requests with Content-Type’s essence as “application/x-www-form-urlencoded”, “multipart/form-data”, or “text/plain”, could potentially be used to invoke routes that only accepts application/json
content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.
For 4.x
users, please update to at least 4.10.2
For 3.x
users, please update to at least 3.29.4
Implement Cross-Site Request Forgery protection using @fastify/csrf
.
Check out the HackerOne report: https://hackerone.com/reports/1763832.