Lucene search
AnonymousNODEJS:1642HistoryMar 03, 2021 - 1:55 a.m.
Prefix escape
2021-03-0301:55:12
Anonymous
www.npmjs.com
23
0.002 Low
EPSS
Percentile
60.9%
Overview
In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service.
If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is.
Recommendation
Upgrade to version 4.0.2
References
| CPE | Name | Operator | Version |
|---|---|---|---|
| fastify-reply-from | lt | 4.0.2 |
Related
github
github
Prefix escape
2021-03-03 01:52:05
osv
osv
CVE-2021-21321
2021-03-02 04:15:12
Prefix escape
2021-03-03 01:52:05
cvelist
cvelist
CVE-2021-21321 Prefix escape
2021-03-02 03:35:25
prion
prion
Design/Logic Flaw
2021-03-02 04:15:00
nvd
nvd
CVE-2021-21321
2021-03-02 04:15:12
cve
cve
CVE-2021-21321
2021-03-02 04:15:12
redhatcve
redhatcve
CVE-2021-21321
2021-03-23 20:37:26
veracode
veracode
Authorization Bypass
2021-03-03 06:00:07
redhat
redhat