Executive brief
fastify-csrf is a Node.js module that protects web applications against cross-site request forgery (CSRF) attacks using a double-submit cookie mechanism. This vulnerability allows attackers to bypass CSRF protections when applications are deployed across multiple subdomains by exploiting cookie tossing attacks, potentially enabling unauthorized actions on behalf of authenticated users.
Technical details
The vulnerability is a CSRF protection bypass in fastify-csrf's double-submit cookie mechanism due to inadequate validation against cookie tossing attacks. The flaw affects applications deployed across multiple subdomains (common in Platform-as-a-Service environments like Heroku) where cookies set on parent domains can be leveraged by an attacker. An attacker can force a user's browser to use a cookie from a subdomain they control to pass the CSRF validation, effectively bypassing the token check. The attack requires user interaction (the victim must visit an attacker-controlled site). Version 3.1.0 and later include fixes, though users hosting on multiple subdomains must additionally supply userInfo when generating CSRF tokens for full protection.
Affected products
- Fastify fastify-csrf < 3.1.0
Timeline
- 2021-05-17: disclosed
- 2021-05-17: patched: Version 3.1.0 released