GitHub Advisoryadvisory · npm
GHSA-84fq-6626-w5fg CORS Token Disclosure in crumb
MEDIUM
Official page ↗
- Aliases
- CVE-2014-7193
- Ecosystem
- npm
- Packages
- crumb
- Severity
- Moderate
- Weaknesses
- CWE-284
- Reviewed
- 2020-06-16
Affected packages
• npm crumb: < 3.0.0 → fixed in 3.0.0
Description
When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.
A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.
Recommendation
Update to version 3.0.0 or greater.
Related
Alias · CVE (1)
- CVE-2014-7193 The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS… vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-7193 advisory
- https://github.com/hapijs/crumb/commit/5e6d4f5c81677fe9e362837ffd4a02394303db3c web
- https://github.com/spumko/crumb/commit/5e6d4f5c81677fe9e362837ffd4a02394303db3c web
- https://github.com/advisories/GHSA-84fq-6626-w5fg advisory
- https://www.npmjs.com/advisories/4 web