Executive brief
Node Connect is a popular middleware library for the Node.js web platform that handles request processing. The methodOverride middleware contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary JavaScript code into error pages. When a user submits a crafted HTTP request, the unsanitized input is echoed back in the 404 error response, enabling account hijacking, session theft, or malware distribution to application users.
Technical details
The vulnerability is a reflected XSS (CWE-79) in the methodOverride middleware, which allows HTTP POST requests to override the request method via the "_method" parameter or "x-http-method-override" header. The vulnerable code in proto.js line 155 constructs an error message ("Cannot [METHOD] [URL]") without properly escaping the req.method value, which comes directly from user input. An attacker can submit a POST request with _method=<script> content to trigger XSS in the 404 error page. The attack requires network access and user interaction (the victim must view the crafted response in a browser), but does not require authentication. The fix was implemented in version 2.8.2, which properly HTML-encodes the method value before rendering it in error responses.
Affected products
- Sencha Labs Connect before 2.8.2
Timeline
- 2013-06-27: disclosed: Issue #831 opened on GitHub
- 2013: patched: Fix committed to senchalabs/connect repository
- 2022-05-05: advisory: GHSA-6w62-83g6-rfhj published
- 2019-12-11: other: CVE-2013-7371 published to NVD