medium5.8
CVE-2014-7193
CORS Token Disclosure in crumb
Impact
When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user. A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all. ## Recommendation Update to version 3.0.0 or greater.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | crumb | < 3.0.0 | 3.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sideway | Hapi Crumb | through 2.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/hapijs/crumb/commit/5e6d4f5c81677fe9e362837ffd4a02394303db3c
- https://nodesecurity.io/advisories/crumb_cors_token_disclosure
- https://github.com/advisories/GHSA-84fq-6626-w5fg
- https://nvd.nist.gov/vuln/detail/CVE-2014-7193
- https://github.com/spumko/crumb/commit/5e6d4f5c81677fe9e362837ffd4a02394303db3c
- https://www.npmjs.com/advisories/4