Executive brief
fastify-static is a Fastify plugin for serving static files in Node.js applications. When the redirect option is enabled, the module is vulnerable to open redirect attacks, allowing attackers to craft URLs that trick users into visiting malicious websites. This can lead to phishing attacks, credential theft, or malware distribution.
Technical details
The vulnerability is a URL redirection flaw (CWE-601) in the fastify-static module's redirect handling. When the redirect option is set to true (disabled by default), an attacker can exploit improper URL parsing by using a double slash (//) followed by a domain name to redirect users to arbitrary external sites (e.g., http://localhost:3000//google.com/%2e%2e). The attack requires user interaction (the victim must click the malicious link) and is primarily effective against Mozilla Firefox. The vulnerability has been patched in version 4.2.4, and can be mitigated by using the rewriteUrl option to sanitize input URLs.
Affected products
- Fastify fastify-static before 4.2.4
Timeline
- 2021-10-05: disclosed
- 2021-10-05: patched: Version 4.2.4 released