# CVE-2013-7370: Sencha Labs Connect reflected XSS in methodOverride middleware

Source: https://junglewise.ai/threats/cve-2013-7370-sencha-labs-connect-reflected-xss-in-methodoverride-middleware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-08-31. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2013-7370 · Severity: info · CVSS 6.1 · Published 2020-08-31

A vulnerability in the Connect middleware for Node.js could allow attackers to execute malicious scripts in a user's browser. This occurs when the application uses the 'methodOverride' feature to process web requests. If an attacker sends a specially crafted request, the server may reflect that script back to the user in an error page, potentially leading to unauthorized actions or data theft from the user's session.

## Quick answers

**Is CVE-2013-7370 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2013-7370 being exploited in the wild.

**How severe is CVE-2013-7370?** Informational severity, with a CVSS score of 6.1, published 31 August 2020.

**Which products and versions are affected?** Sencha Labs connect < 2.8.1.

**Is there a fix for CVE-2013-7370?** A patch was published on 2013-07-24: Fixes committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2013-7370 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2013-7370?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the 'methodOverride' middleware of the Connect framework. The middleware allows an HTTP POST request to override the request method using the '_method' parameter or 'x-http-method-override' header. Because the input provided to these fields was not validated or sanitized, an attacker could inject a script as the method name. When the application fails to find a matching route for the malicious method, it returns a 404 error page that includes the unescaped method string in the response body (e.g., 'Cannot [method] [url]'). This allows for the execution of arbitrary JavaScript in the context of the victim's browser session. The issue was addressed in version 2.8.1 by escaping the output and whitelisting supported methods.

## Affected products

- Sencha Labs connect < 2.8.1

## Identifiers

- CVE-2013-7370
- GHSA-3fw8-66wf-pr7m

## Timeline

- 2013-06-27: disclosed: Issue reported on GitHub repository
- 2013-07-24: patched: Fixes committed to repository
- 2019-12-11: advisory: NVD published CVE-2013-7370
- 2020-08-31: advisory: GitHub Advisory published

## References

- [https://github.com/senchalabs/connect/issues/831](https://github.com/senchalabs/connect/issues/831)
- [https://github.com/senchalabs/connect/commit/126187c4e12162e231b87350740045e5bb06e93a](https://github.com/senchalabs/connect/commit/126187c4e12162e231b87350740045e5bb06e93a)
- [https://github.com/senchalabs/connect/commit/277e5aad6a95d00f55571a9a0e11f2fa190d8135](https://github.com/senchalabs/connect/commit/277e5aad6a95d00f55571a9a0e11f2fa190d8135)
- [https://access.redhat.com/security/cve/cve-2013-7370](https://access.redhat.com/security/cve/cve-2013-7370)
- [https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7370](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7370)
- [https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-7370](https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-7370)