@fastify/http-proxy WebSocket Prefix Escape Vulnerability via Path Traversal

A vulnerability exists in @fastify/http-proxy versions 9.4.0 prior to 11.5.0, allowing WebSocket requests to escape the intended rewrite prefix and access upstream endpoints that should be hidden. This is achieved by exploiting the WebSocket routing path, which normalizes dot segments and can be manipulated to traverse out of the designated prefix. The issue arises because the proxy does not properly validate WebSocket destination paths against the rewrite prefix, creating a path traversal vulnerability. Exploitation requires a non-normalizing WebSocket client, such as a raw HTTP client or one that forwards requests without modification.

Impact

Exploitation of this vulnerability bypasses the rewrite prefix access control for WebSocket connections, allowing an attacker to access and interact with upstream WebSocket endpoints that were meant to be concealed. This could lead to unauthorized access to internal or administrative WebSocket APIs, potentially causing data exfiltration or other harmful effects.

Remediation

Users are advised to upgrade to @fastify/http-proxy version 11.6.0 or later.