Authentication Bypass Affecting crumb Open this link in a new tab package, versions <4.0.2


0.0
medium
  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    npm:crumb:20150213

  • published

    21 Jun 2017

  • disclosed

    12 Feb 2015

  • credit

    Nicolas Jessel

Introduced: 12 Feb 2015

CWE-592 Open this link in a new tab

How to fix?

Upgrade crumb to version 4.0.2 or higher.

Overview

crumb is CSRF crumb generation and validation plugin.

Affected versions of the package are vulnerable to Authentication Bypass. crumb does not validate the hostname while comparing a request origin against the whitelist, but rather compare http protocol alone. This opens a window for attackers to gain information by Man in the Middle (MitM) attacks.