GHSA-2q7r-29rg-6m5h
fastify-reply-from affected by bypass of reply forwarding
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @fastify/reply-from | < 12.5.0 | 12.5.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
By crafting a malicious URL, an attacker could access routes that are not allowed, even though the `reply.from` is defined for specific routes in `@fastify/reply-from`.
### Details
An attacker can bypass the route defined by the `@fastify/reply-from` package by adding a `..` symbol, which, for `curl` version `8.7.1`, is `%2e%2e`.
### Impact
Everyone is using this package with the routes option to protect a 3rd-party resource.
References
External links from the advisory. They lead to third-party sites.