Bug 1942182 (CVE-2021-21322)

Summary:	CVE-2021-21322 fastify-http-proxy: crafted URL allows prefix scape of the proxied backend service
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	gghezzo, gparvin, jramanat, jweiser, stcannon, thee
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	fastify-http-proxy 4.3.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in fastify-http-proxy. Escaping the prefix of the proxied backend service is possible by an attacker using a specially crafted URL. The highest threat from this vulnerability is to data confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-04-13 06:39:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1942265, 1942266
Bug Blocks:	1942183

Description Guilherme de Almeida Suckevicz 2021-03-23 19:51:41 UTC

fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks. By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.3.1.

Reference:
https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-c4qr-gmr9-v23w

Upstream patch:
https://github.com/fastify/fastify-http-proxy/commit/02d9b43c770aa16bc44470edecfaeb7c17985016

Comment 2 Jan Werner 2021-04-05 15:31:55 UTC

Statement:

The impact of this flaw largely depends on the environment where the affected library is being used. This flaw could be used to redirect an adversary to an exposed, unprotected endpoint. Depending on the functionality of the affected endpoint that could result in a loss of confidentiality, integrity and availability.  The severity of this flaw in for Red Had Advanced Cluster Management for Kubernetes is rated as important as there are no exposed, un-authenticated endpoints that could be accessed by exploiting this flaw.

Comment 3 Jan Werner 2021-04-05 15:48:49 UTC

External References:

https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-c4qr-gmr9-v23w

Comment 4 errata-xmlrpc 2021-04-13 00:09:46 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8
  Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7

Via RHSA-2021:1168 https://access.redhat.com/errata/RHSA-2021:1168

Comment 5 Product Security DevOps Team 2021-04-13 06:39:27 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21322

Comment 6 errata-xmlrpc 2021-08-06 00:50:45 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 7
  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8

Via RHSA-2021:3016 https://access.redhat.com/errata/RHSA-2021:3016