CVE-2021-29624: Reliance on Cookies without Validation and Integrity Checking
(updated )
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf have a “double submit” mechanism using cookies with an application deployed across multiple subdomains, e.g. “heroku”-style platform as a service. of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a userInfo when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.
References
- cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
- github.com/advisories/GHSA-rc4q-9m69-gqp8
- github.com/fastify/csrf/pull/2
- github.com/fastify/fastify-csrf/pull/51
- github.com/fastify/fastify-csrf/releases/tag/v3.1.0
- github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8
- nvd.nist.gov/vuln/detail/CVE-2021-29624
- owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf
Code Behaviors & Features
Detect and mitigate CVE-2021-29624 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →