Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg0ZnEtNjYyNi13NWZn

CORS Token Disclosure in crumb

When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.

A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.

Recommendation

Update to version 3.0.0 or greater.

Permalink: https://github.com/advisories/GHSA-84fq-6626-w5fg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg0ZnEtNjYyNi13NWZn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 7 years ago
Updated: almost 2 years ago

Identifiers: GHSA-84fq-6626-w5fg, CVE-2014-7193
References:

• https://nvd.nist.gov/vuln/detail/CVE-2014-7193
• https://github.com/spumko/crumb/commit/5e6d4f5c81677fe9e362837ffd4a02394303db3c
• https://github.com/advisories/GHSA-84fq-6626-w5fg
• https://www.npmjs.com/advisories/4
• https://github.com/hapijs/crumb/commit/5e6d4f5c81677fe9e362837ffd4a02394303db3c

Repository: https://github.com/spumko/crumb
Blast Radius: 0.0

Affected Packages