Executive brief
fastify-http-proxy is a Fastify plugin that routes HTTP requests to a backend service, with path prefixes used to separate public from private routes. This vulnerability allows an attacker to bypass path prefix restrictions by crafting a malicious URL, enabling unauthorized access to backend paths that should be protected.
Technical details
A path traversal/prefix escape vulnerability exists in fastify-http-proxy's URL routing logic (CWE-20: Improper Input Validation). When a base prefix is configured (e.g., `/pub/`), the proxy fails to properly validate incoming URLs, allowing attackers to craft specific URLs that escape the prefix and access unintended backend paths. The vulnerability is remotely exploitable without authentication or user interaction. An attacker can craft URLs to access backend services outside the intended prefix boundary (e.g., accessing `/priv` when only `/pub` should be accessible). The fix is available in versions 4.3.1 and later.
Affected products
- Fastify fastify-http-proxy all versions before 4.3.1
Timeline
- 2021-02-23: disclosed
- 2021-03-03: advisory
- 2021-03-02: patched: Fix available in v4.3.1 and later