CORS Token Disclosure Affecting crumb package, versions <3.0.0
Snyk CVSS
Attack Complexity
Low
User Interaction
Required
Threat Intelligence
EPSS
0.27% (66th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:crumb:20140801
- published 1 Aug 2014
- disclosed 1 Aug 2014
- credit Marcus Stong
Introduced: 1 Aug 2014
CVE-2014-7193 Open this link in a new tabHow to fix?
Update crumb to version 3.0.0 or greater.
Overview
When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.
A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.
Source: Node Security Project