Executive brief
Finastra's nestjs-proxy is a middleware library used to forward HTTP requests to backend services. The library automatically forwarded authorization headers to all backend services without a way to restrict them, potentially exposing OAuth tokens and other sensitive credentials to services that should not have access to them. Developers must upgrade to a patched version that provides opt-out control per service.
Technical details
This vulnerability is an information disclosure (CWE-200) in the nestjs-proxy library's HTTP header forwarding logic. The vulnerable component lacks a configuration mechanism to selectively disable authorization header forwarding on a per-backend-service basis. An attacker with high privilege and ability to influence user interaction could trick an application into forwarding OAuth tokens or other authorization credentials to untrusted backend services. The fix introduces a forwardToken configuration option that allows developers to opt out of header forwarding per service. The vulnerability affects all versions prior to 0.7.0 of @finastra/nestjs-proxy; the deprecated @ffdc/nestjs-proxy should be migrated away from.
Affected products
- Finastra nestjs-proxy before 0.7.0
- Finastra ffdc/nestjs-proxy all versions (deprecated)
Timeline
- 2022-06-17: disclosed
- 2022-06-17: patched: Fixed in version 0.7.0