CVE-2021-29624

Katalog CVE

CVSS 6.5 · Medium EPSS 0,83%

Kerentanan Reliance on Cookies without Validation and Integrity Checking pada fastify-csrf. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.

Rincian

Terbit di NVD

19 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-565: Reliance on Cookies without Validation and Integrity Checking
CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fastify/csrf/pull/2 patch · advisory pihak ketiga
• https://github.com/fastify/fastify-csrf/pull/51 patch · advisory pihak ketiga
• https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8 patch · advisory pihak ketiga
• https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html advisory pihak ketiga
• https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0 advisory pihak ketiga
• https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf advisory pihak ketiga