CVE-2022-39288
published 2022-10-10CVE-2022-39288: fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the…
PriorityP355high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
59.24%
99.0th percentile
fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. An attacker can send an invalid Content-Type header that can cause the application to crash. This issue has been addressed in commit `fbb07e8d` and will be included in release version 4.8.1. Users are advised to upgrade. Users unable to upgrade may manually filter out http content with malicious Content-Type headers.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fastify | fastify | < 4.8.1 | 4.8.1 |
| fastify | fastify | — | — |
| fastify | fastify | >= 4.0.0 < 4.8.1 | 4.8.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
fastify vulnerable to denial of service via malicious Content-Type
ghsa·2022-10-11
CVE-2022-39288 [HIGH] CWE-754 fastify vulnerable to denial of service via malicious Content-Type
fastify vulnerable to denial of service via malicious Content-Type
### Impact
An attacker can send an invalid `Content-Type` header that can cause the application to crash, leading to a possible Denial of Service attack. Only the v4.x line is affected.
(This was updated: upon a close inspection, v3.x is not affected after all).
### Patches
Yes, update to `> v4.8.0`.
### Workarounds
You can reject the malicious content types before the body parser enters in action.
```js
const badNames = Object.getOwnPropertyNames({}.__proto__)
fastify.addHook('onRequest', async (req, reply) => {
for (const badName of badNames) {
if (req.headers['content-type'].indexOf(badName) > -1) {
reply.code(415)
throw new Error('Content type not supported')
}
}
})
```
### References
See the HackerOne report [#17
OSV
fastify vulnerable to denial of service via malicious Content-Type
osv·2022-10-11
CVE-2022-39288 [HIGH] fastify vulnerable to denial of service via malicious Content-Type
fastify vulnerable to denial of service via malicious Content-Type
### Impact
An attacker can send an invalid `Content-Type` header that can cause the application to crash, leading to a possible Denial of Service attack. Only the v4.x line is affected.
(This was updated: upon a close inspection, v3.x is not affected after all).
### Patches
Yes, update to `> v4.8.0`.
### Workarounds
You can reject the malicious content types before the body parser enters in action.
```js
const badNames = Object.getOwnPropertyNames({}.__proto__)
fastify.addHook('onRequest', async (req, reply) => {
for (const badName of badNames) {
if (req.headers['content-type'].indexOf(badName) > -1) {
reply.code(415)
throw new Error('Content type not supported')
}
}
})
```
### References
See the HackerOne report [#17
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3https://github.com/fastify/fastify/security/advisories/GHSA-455w-c45v-86rghttps://github.com/fastify/fastify/security/policyhttps://github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3https://github.com/fastify/fastify/security/advisories/GHSA-455w-c45v-86rghttps://github.com/fastify/fastify/security/policy
2022-10-10
Published