CVE-2021-22964
📋 TL;DR
A path traversal vulnerability in fastify-static module allows attackers to redirect Firefox users to arbitrary websites via crafted URLs containing double slashes. It also enables denial-of-service attacks through invalid characters. Only applications with the redirect:true option enabled are affected.
💻 Affected Systems
- fastify-static
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could redirect users to malicious phishing sites or cause service disruption through DoS attacks, potentially leading to credential theft or service unavailability.
Likely Case
Most probable impact is limited DoS attacks or redirection to unwanted sites for Firefox users accessing vulnerable applications.
If Mitigated
With redirect:false (default), no impact. With proper input validation and updated versions, minimal risk.
🎯 Exploit Status
Exploitation requires crafting URLs with double slashes or invalid characters. Firefox specifically vulnerable to redirection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.1
Vendor Advisory: https://github.com/fastify/fastify-static/security/advisories/GHSA-8w3w-2jfq-9q5q
Restart Required: Yes
Instructions:
1. Update fastify-static to version 4.4.1 or later. 2. Run npm update fastify-static or yarn upgrade fastify-static. 3. Restart your application.
🔧 Temporary Workarounds
Disable redirect option
allSet redirect option to false in fastify-static configuration
In your fastify-static configuration, ensure: redirect: false
🧯 If You Can't Patch
- Implement WAF rules to block URLs containing double slashes followed by domains
- Use reverse proxy to sanitize and validate incoming URLs before reaching application
🔍 How to Verify
Check if Vulnerable:
Check package.json for fastify-static version and verify if redirect:true is configuredCheck Version:
npm list fastify-static or check package.json versionVerify Fix Applied:
Confirm fastify-static version is >=4.4.1 and test with known exploit URLs📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing // followed by domain names
- Requests with invalid characters like ^ in URL paths
Network Indicators:
- Unusual redirect patterns from your application
- HTTP 302/301 responses to unexpected domains
SIEM Query:
http.url:*//* AND http.status_code:302