CORS Bypass Affecting hapi package, versions <11.0.0


0.0
low

Snyk CVSS

    Attack Complexity High

    Threat Intelligence

    EPSS 0.11% (44th percentile)
Expand this section
NVD
5.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID npm:hapi:20151020
  • published 6 Nov 2015
  • disclosed 20 Oct 2015
  • credit Eran Hammer

How to fix?

Upgrade to a version 11.0.0 or greater.

Overview

Hapi v11.0.0 and below have an incorrect implementation of the CORS protocol, and allow for configurations that, at best, return inconsistent headers and, at worst, cross-origin activities that are expected to be forbidden.

Details

If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.