Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability allows attackers to bypass security controls by manipulating the connection header in requests. When used in proxy or gateway scenarios, this could enable unauthorized access or manipulation of upstream services.
- Bypasses proxy security headers.
- Impacts services handling external requests.
- Allows header manipulation.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this by manipulating the `Connection` header in requests sent to a vulnerable proxy. This allows them to remove security or routing headers added by the proxy, potentially bypassing access controls or redirecting traffic maliciously. This is effective against systems using @fastify/reply-from or @fastify/http-proxy before patches.
- Target common proxy plugins.
- Manipulate `Connection` header.
- Bypass proxy security controls.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows attackers to bypass security controls by manipulating the `Connection` header to remove proxy-added headers. Attackers may favor weaponizing this since it can strip critical security or routing information, potentially enabling unauthorized access or other malicious actions. The affected libraries are often exposed externally.
- Exploitable via network access.
- Public exploit code is not yet available.
- Libraries are commonly internet-facing.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize upgrading `@fastify/reply-from` and `@fastify/http-proxy` to versions `v12.6.2` and `v11.4.4` respectively to address the critical vulnerability. If immediate patching is not feasible, implement strict ingress filtering and monitor network traffic for suspicious header manipulation attempts.
- Upgrade to patched versions.
- Block or monitor suspicious Connection header usage.
- Review proxy configurations for header rewrite logic.
