crumb@1.1.0 vulnerabilities

CSRF crumb generation and validation plugin

latest version

7.2.3

latest non vulnerable version

7.2.3

first published

12 years ago

latest version published

6 years ago

deprecated

Package is deprecated

licenses detected

BSD-2-Clause
>=0.0.1 <6.0.0

View crumb package health on Snyk Advisor (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the crumb package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Authentication Bypass `crumb` is CSRF crumb generation and validation plugin. Affected versions of the package are vulnerable to Authentication Bypass. `crumb` does not validate the hostname while comparing a request origin against the whitelist, but rather compare http protocol alone. This opens a window for attackers to gain information by Man in the Middle (MitM) attacks. How to fix Authentication Bypass? Upgrade `crumb` to version 4.0.2 or higher.	<4.0.2
M CORS Token Disclosure When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user. A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all. Source: Node Security Project How to fix CORS Token Disclosure? Update crumb to version 3.0.0 or greater.	<3.0.0

Authentication Bypass

crumb is CSRF crumb generation and validation plugin.

Affected versions of the package are vulnerable to Authentication Bypass. crumb does not validate the hostname while comparing a request origin against the whitelist, but rather compare http protocol alone. This opens a window for attackers to gain information by Man in the Middle (MitM) attacks.

How to fix Authentication Bypass?

Upgrade crumb to version 4.0.2 or higher.

<4.0.2

CORS Token Disclosure

When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.

A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.

Source: Node Security Project

How to fix CORS Token Disclosure?

Update crumb to version 3.0.0 or greater.

<3.0.0

Go back to all versions of this package