Authentication Bypass in NestJS Fastify Adapter

Compliance Impact

The vulnerability allows an unauthenticated client to bypass authentication middleware by appending a trailing slash to the request URL, potentially granting unauthorized access to protected resources.

Such unauthorized access could lead to exposure or compromise of sensitive data, which may impact compliance with data protection regulations like GDPR and HIPAA that require strict access controls and protection of personal or health information.

Therefore, this vulnerability could negatively affect compliance with these standards by undermining authentication mechanisms and increasing the risk of data breaches.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the NestJS framework, specifically in the @nestjs/platform-fastify package before version 11.1.24. It allows an unauthenticated client to bypass the authentication middleware registered for certain routes when using the Fastify adapter. The bypass occurs if the client appends a trailing slash (/) to the request URL, causing the middleware to be skipped under the default Fastify configuration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized users to access protected routes or resources without proper authentication by exploiting the trailing slash bypass. This could lead to unauthorized access to sensitive data or functionality, potentially compromising the security of applications built with the affected NestJS versions.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the @nestjs/platform-fastify package to version 11.1.24 or later, where the authentication bypass issue has been fixed.

Additionally, review your middleware registration using MiddlewareConsumer.forRoutes() on the Fastify adapter to ensure no unauthenticated access is possible via trailing slashes in request URLs.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when middleware registered via NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter can be bypassed by appending a trailing slash (/) to the request URL.

To detect this vulnerability on your system or network, you can test the affected routes by sending HTTP requests both with and without a trailing slash and observe if the middleware is bypassed.

For example, you can use curl commands to test the behavior:

• curl -i http://yourserver/yourroute
• curl -i http://yourserver/yourroute/

If the request with the trailing slash bypasses authentication or middleware checks that the request without the trailing slash does not, your system is vulnerable.

Useful 0 Not Useful 0