Rosetta-flash jsonp vulnerability Affecting hapi package, versions < 6.1.0
Threat Intelligence
EPSS
1.79% (89th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:hapi:20140708-1
- published 8 Jul 2014
- disclosed 8 Jul 2014
- credit Michele Spagnuolo
Introduced: 8 Jul 2014
CVE-2014-4671 Open this link in a new tabHow to fix?
Upgrade to the latest version of hapi.js
Overview
This description taken from the pull request provided by Patrick Kettner.
tl:dr - someone created a alphanum only swf converter, which means that they can in theory use it as a callback at a JSONP endpoint, and as a result, send data across domains.
Prepending callbacks with an empty inline comment breaks the flash parser, and prevents the issue. This is a fairly common solution currently being implemented by Google, Facebook, and GitHub.
Source: Node Security Project
CVSS Scores
version 3.1