CVE-2015-9243: Unsafe Merging of CORS Configuration Conflict in hapi

Background

The hapi package is a rich framework for building applications and services in Node.js. It provides a robust set of features for handling HTTP requests, routing, and other server-side functionalities. However, versions prior to 11.1.4 are susceptible to a vulnerability that allows route-level CORS configuration to override connection-level or server-level CORS defaults. This can lead to less restrictive CORS permissions than intended, potentially exposing the application to cross-origin attacks.

Vulnerability Detail

The vulnerability in hapi arises from the incorrect merging of CORS configuration settings. When configuring CORS at the route level, the settings should be combined with the existing connection-level or server-level CORS defaults. However, prior to version 11.1.4, hapi overrides the defaults with the route-level configuration, resulting in less restrictive CORS permissions. This can allow malicious actors to bypass intended access controls and perform unauthorized actions on behalf of authenticated users. The vulnerability is classified as CWE-284, indicating a weakness in the application's CORS implementation.

npm install hapi@18.1.0

npm install hapi@11.1.4

Workaround

If updating hapi is not immediately feasible, a temporary workaround can be implemented by manually merging the route-level CORS configuration with the connection-level or server-level defaults. This can be achieved by modifying the code responsible for setting up the CORS configuration. Here is an example of how the merging can be done:

const Hapi = require('hapi');

const server = new Hapi.Server();

// Set up connection-level CORS defaults
server.connection({
  routes: {
    cors: {
      origin: ['https://example.com'],
      headers: ['Authorization'],
      additionalHeaders: ['X-Custom-Header'],
      credentials: true
    }
  }
});

// Set up route-level CORS configuration
server.route({
  method: 'GET',
  path: '/api/data',
  config: {
    cors: {
      origin: ['https://example.com', 'https://api.example.com'],
      headers: ['Authorization', 'Content-Type'],
      additionalHeaders: ['X-Custom-Header'],
      credentials: true
    }
  },
  handler: (request, reply) => {
    // Route handler implementation
  }
});

// Manually merge route-level CORS configuration with connection-level defaults
const mergedCorsConfig = Object.assign({}, server.connections[0].settings.routes.cors, server.connections[0].table()[0].settings.cors);

// Apply the merged CORS configuration to the route
server.connections[0].table()[0].settings.cors = mergedCorsConfig;

Conclusion

In conclusion, the hapi package prior to version 11.1.4 is vulnerable to an unsafe merging of CORS configuration, which can result in less restrictive CORS permissions than intended. To mitigate this vulnerability, it is crucial to update hapi to version 11.1.4 or later. If immediate updating is not possible, the provided workaround can be implemented. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for hapi →

FAQ