Executive brief
The @fastify/csrf-protection library, used in Node.js web applications to prevent cross-site request forgery (CSRF) attacks, can be bypassed when the optional userInfo parameter is missing or predictable. An attacker can forge valid CSRF tokens and trick users into performing unintended actions, such as submitting forms or transferring funds, without the user's knowledge.
Technical details
The vulnerability is a CSRF bypass (CWE-352) in @fastify/csrf-protection when used with @fastify/cookie. The library supports an optional userInfo parameter to bind CSRF tokens to a specific user. When userInfo is absent or predictable, network and same-site attackers can perform cookie fixation and forge valid CSRF tokens. The root cause is insufficient cryptographic binding of the token to the user identity before version 6.3.0 (and v4.1.0). An attacker requires no authentication but needs user interaction (victim clicking a link/visiting a page). The fix adds a server-defined hmacKey that cryptographically binds the CSRF token to the _csrf cookie value and userInfo parameter, making token forgery impossible provided each user has a unique userInfo.
Affected products
- Fastify @fastify/csrf-protection < 4.1.0, >= 5.0.0 and < 6.3.0
Timeline
- 2023-04-20: disclosed: Advisory published on GitHub and OSV database
- 2023-04-20: patched: Fixed in versions 4.1.0 and 6.3.0