CVE-2021-29624: fastify fastify-csrf

Vulnerability summary

CVE-2021-29624 is a medium (CVSS 6.5) vulnerability in fastify fastify-csrf. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.8% of scored vulnerabilities.

Timeline

1. 19-05-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.

• CWE-565Reliance on Cookies without Validation and Integrity CheckingThe product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.