CVE-2021-22963: fastify fastify-static Open Redirect

Vulnerability summary

CVE-2021-22963 is a medium (CVSS 6.1) Open Redirect vulnerability in fastify fastify-static. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 66.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 14-10-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.

• CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.