Headline
CVE-2021-29624: Release v3.1.0 · fastify/csrf-protection
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a “double submit” mechanism using cookies with an application deployed across multiple subdomains, e.g. “heroku”-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a userInfo when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.
📚 PR:
- Update README.md (#33)
- Clarify the security implication of using this module in the README (#34)
- Fix typo (#35)
- ci(dependabot): update github actions (#37)
- Bump fastify/github-action-merge-dependabot from v1 to v2.0.0 (#39)
- Bump tap from 14.11.0 to 15.0.0 (#42)
- Bump sinon from 9.2.4 to 10.0.0 (#38)
- Bump @types/node from 14.14.42 to 15.0.0 (#46)
- Bump tsd from 0.14.0 to 0.15.0 (#48)
- Bump actions/setup-node from 1 to 2.1.5 (#50)
- Bump actions/checkout from 2 to 2.3.4 (#49)
- ci: add nodejs v16 to test matrix (#47)
- docs(readme): minor grammar changes (#44)
- chore(gitignore): use latest github ignore template (#36)
- chore: ci updates and style change (#43)
- Support userInfo (#51)
Related news
@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions. @fastify/csrf-protection supports an optional userInfo parameter that binds the CSRF token to the user. This parameter has been introduced to prevent cookie-tossing attacks as a fix for CVE-2021-29624. Whenever userInfo parameter is missing, or its value can be predicted for the target user account, network and same-site attackers can 1. fixate a _csrf cookie in the victim's browser, and 2. forge CSRF tokens that are valid for the victim's session. This allows attackers to bypass the CSRF protection mechanism. As a fix, @fastify/csrf-protection starting from version 6.3.0 (and v4.1.0) includes a server-defined secret hmacKey that cryptographically binds the CSRF token to the value of the _csrf cookie and the use...