Impact
The attacker can use the incorrect Content-Type
to bypass the Pre-Flight
checking of fetch
. fetch()
requests with Content-Type’s essence as “application/x-www-form-urlencoded”, “multipart/form-data”, or “text/plain”, could potentially be used to invoke routes that only accepts application/json
content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.
Patches
For 4.x
users, please update to at least 4.10.2
For 3.x
users, please update to at least 3.29.4
Workarounds
Implement Cross-Site Request Forgery protection using @fastify/csrf
.
References
Check out the HackerOne report: https://hackerone.com/reports/1763832.