The attacker can use the incorrect Content-Type
to bypass the Pre-Flight
checking of fetch
. fetch()
requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json
content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.
For 4.x
users, please update to at least 4.10.2
For 3.x
users, please update to at least 3.29.4
Implement Cross-Site Request Forgery protection using @fastify/csrf
.
Check out the HackerOne report: https://hackerone.com/reports/1763832.
{ "nvd_published_at": "2022-11-22T20:15:00Z", "github_reviewed_at": "2022-11-21T22:28:11Z", "github_reviewed": true, "cwe_ids": [ "CWE-352" ], "severity": "MODERATE" }