Fastify up to 0.37.x on Node.js Content-Type data processing

Summaryinfo

A vulnerability marked as problematic has been reported in Fastify up to 0.37.x on Node.js. This affects an unknown function. Performing a manipulation as part of Content-Type results in data processing. This vulnerability was named CVE-2018-3711. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Fastify up to 0.37.x on Node.js (JavaScript Library). It has been classified as problematic. This affects an unknown code. The manipulation as part of a Content-Type leads to a data processing vulnerability. CWE is classifying the issue as CWE-19. This is going to have an impact on availability. The summary by CVE is:

Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload.

The bug was discovered 01/25/2018. The weakness was presented 06/07/2018 (Website). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2018-3711 since 12/28/2017. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 132 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 0.38.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• JavaScript Library

Name

• Fastify

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37

Website

• Product: https://github.com/fastify/fastify/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion