CORS Bypass Affecting hapi package, versions <11.0.0
Threat Intelligence
EPSS
0.11% (46th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:hapi:20151020
- published 6 Nov 2015
- disclosed 20 Oct 2015
- credit Eran Hammer
Introduced: 20 Oct 2015
CVE-2015-9236 Open this link in a new tabHow to fix?
Upgrade to a version 11.0.0 or greater.
Overview
Hapi v11.0.0 and below have an incorrect implementation of the CORS protocol, and allow for configurations that, at best, return inconsistent headers and, at worst, cross-origin activities that are expected to be forbidden.
Details
If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
CVSS Scores
version 3.1