NVD Vulnerability Detail

CVE-2021-29624

Summary	fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.
Publication Date	May 20, 2021, 7:15 a.m.
Registration Date	May 20, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:01 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:fastify:fastify-csrf::::::node.js::*					3.1.0

Related information, measures and tools

No	URL	タグ
1	https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html	Third Party Advisory
2	https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html	Third Party Advisory
3	https://github.com/fastify/csrf/pull/2	Patch Third Party Advisory
4	https://github.com/fastify/csrf/pull/2	Patch Third Party Advisory
5	https://github.com/fastify/fastify-csrf/pull/51	Patch Third Party Advisory
6	https://github.com/fastify/fastify-csrf/pull/51	Patch Third Party Advisory
7	https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0	Third Party Advisory
8	https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0	Third Party Advisory
9	https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8	Patch Third Party Advisory
10	https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8	Patch Third Party Advisory
11	https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf	Third Party Advisory
12	https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-352	クロスサイト・リクエスト・フォージェリ（CSRF）	https://cwe.mitre.org/data/definitions/352.html
2	CWE-352	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html

JVN Vulnerability Information

fastify-csrf における検証および完全性チェックを行っていない Cookie への依存に関する脆弱性

Title	fastify-csrf における検証および完全性チェックを行っていない Cookie への依存に関する脆弱性
Summary	fastify-csrf には、検証および完全性チェックを行っていない Cookie への依存に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 13, 2021, midnight
Registration Date	Feb. 3, 2022, 4:02 p.m.
Last Update	Feb. 3, 2022, 4:02 p.m.

Affected System

fastify

fastify-csrf 3.1.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-29624	https://www.cve.org/CVERecord?id=CVE-2021-29624
National Vulnerability Database (NVD)
2	CVE-2021-29624	https://nvd.nist.gov/vuln/detail/CVE-2021-29624

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-565	https://cwe.mitre.org/data/definitions/565.html

ベンダー情報

No	Name	URL
GitHub
1	Add utilities to prevent cookie tossing and replay attacks #2	https://github.com/fastify/csrf/pull/2
2	Lack of protection against cookie tossing attacks in fastify-csrf	https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8
3	Support userInfo #51	https://github.com/fastify/fastify-csrf/pull/51
4	v3.1.0	https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0

Change Log

No	Changed Details	Date of change
1	[2022年02月03日] 掲載	Feb. 3, 2022, 4:02 p.m.