← Volver a CVEs

CVE-2021-29624

MEDIUM

6.5

Descripcion

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.

Detalles CVE

Puntuacion CVSS v3.16.5

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado5/19/2021

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

fastify:fastify-csrf

Debilidades (CWE)

CWE-565CWE-352

Referencias

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html(security-advisories@github.com)

https://github.com/fastify/csrf/pull/2(security-advisories@github.com)

https://github.com/fastify/fastify-csrf/pull/51(security-advisories@github.com)

https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0(security-advisories@github.com)

https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8(security-advisories@github.com)

https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf(security-advisories@github.com)

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/fastify/csrf/pull/2(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/fastify/fastify-csrf/pull/51(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8(af854a3a-2127-422b-91ae-364da2661108)

https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.