POJIA破甲
地图 / Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDN

Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDN

注入与走私 / HTTP 请求走私 / #1025575

厂商
Node.js third-party modules
严重程度
低危 · CVSS 5.9
赏金
—
弱点
HTTP 请求走私
研究员
@trygve_lie
披露日期
2020-12-10
资产
fastify
CVE
CVE-2020-7764

该报告还没有中文解读。

原文摘录

摘自原文(4390 字符中的一小部分)
I would like to report possible cache poisoning in Fastify It allows an attacker to perform an cache poisoning when Fastify is used in combination with a http cache / CDN.
原文中的代码
const app = require('fastify')();

app.get('/', async () => {
    return { hello: 'world' };
});

const start = async () => {
    await app.listen(9000)
}
start();

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Node.js third-party modules 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @trygve_lie · 版权归作者与 Node.js third-party modules 所有

同类报告

Bypass for #488147 enables stored XSS on https://paypal.com/signin againPayPal · 2019-08-07 · $20,000Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesSlack · 2020-03-12Stored XSS on https://paypal.com/signin via cache poisoningPayPal · 2019-08-07 · $18,900Request smuggling on admin-official.line.me could lead to account takeoverLY Corporation · 2020-05-19Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.comEternal · 2020-07-09Password theft login.newrelic.com via Request SmugglingNew Relic · — · $3,000