CVE-2014-7193: CORS Token Disclosure in crumb
Summary
CVE-2014-7193: CORS Token Disclosure in crumb. Affects crumb versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The crumb package is an npm package used in the hapi framework. It provides Cross-Site Request Forgery (CSRF) protection by generating and validating tokens. The package is commonly used in web applications to prevent unauthorized actions. However, a vulnerability exists in crumb when CORS (Cross-Origin Resource Sharing) is enabled on a hapi route handler. This vulnerability allows an attacker to set a crumb token for a different domain, potentially leading to unauthorized access to non-CORS routes as the user. It is important to note that this vulnerability is unlikely to occur in most configurations, as CORS is typically set globally or not at all.
Vulnerability Detail
The vulnerability arises from the ability to set a crumb token for a different domain when CORS is enabled on a hapi route handler. An attacker can exploit this by having an application consumer visit a site they control, requesting a route that supports CORS, and retrieving the token. With this token, the attacker can potentially make requests to non-CORS routes as the user, bypassing the intended security measures. The impact of this vulnerability depends on the specific configuration and usage of crumb in the application.
How To Fix
Minimum fixed version
3.0.0
This is the first release that contains the fix.
npm install crumb@3.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The CORS token disclosure vulnerability in the crumb package can potentially lead to unauthorized access to non-CORS routes. It is recommended to update to the latest version of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for crumb →
FAQ
Crumb is an npm package used in the hapi framework to provide CSRF protection. It generates and validates tokens to prevent unauthorized actions in web applications.
The vulnerability occurs when CORS is enabled on a hapi route handler. It allows an attacker to set a crumb token for a different domain, potentially leading to unauthorized access to non-CORS routes.
The impact of this vulnerability depends on the specific configuration and usage of crumb in the application. It could potentially allow an attacker to bypass security measures and make unauthorized requests as the user.
No, this vulnerability is unlikely to occur in most configurations. Most configurations either set CORS globally (where crumb is not used) or do not use CORS at all.
To fix this vulnerability, update the crumb package to version 3.0.0 or greater.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.