crumb

CORS Token Disclosure

Severity: moderate

Overview

When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.

A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.

Remediation

Update to version 3.0.0 or greater.

Vulnerable versions

0.0.1
6 years ago
0.0.2
6 years ago
0.0.3
6 years ago
0.0.4
6 years ago
0.0.5
6 years ago
0.0.6
6 years ago
0.0.7
5 years ago
0.0.8
5 years ago
0.0.9
5 years ago
0.1.0
5 years ago
0.1.1
5 years ago
0.1.2
5 years ago
0.1.3
5 years ago
0.2.0
5 years ago
0.3.0
5 years ago
0.3.1
5 years ago
0.3.2
5 years ago
1.0.0
5 years ago
1.1.0
4 years ago
1.1.1
4 years ago
1.1.2
4 years ago
2.0.0
4 years ago
2.1.0
4 years ago
2.2.0
4 years ago

Unaffected versions

3.0.0
4 years ago
3.0.1
4 years ago
3.1.0
4 years ago
3.2.0
4 years ago
3.3.0
4 years ago
4.0.0
4 years ago
4.0.1
4 years ago
4.0.2
4 years ago
4.0.3
3 years ago
4.0.4
3 years ago
5.0.0
3 years ago
6.0.0
3 years ago
6.0.1
2 years ago
6.0.2
2 years ago
6.0.3
2 years ago
7.0.0
9 months ago
7.1.0
4 months ago
6.1.0
4 months ago

Advisory timeline

  1. Published

    Advisory published
    Aug 1st, 2014
  2. Reported

    Initial report by Marcus Stong
    Oct 17th, 2015