Is CVE-2013-7371 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2013-7371 being exploited in the wild.

How severe is CVE-2013-7371?

Low severity, with a CVSS score of 3.1, published 5 May 2022.

Which products and versions are affected?

connect (npm) SEMVER:introduced=0,fixed=2.8.2.

Is there a fix for CVE-2013-7371?

Yes. connect (npm): upgrade to 2.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2013-7371 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2013-7371?

Check whether you run connect (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2013-7371: Node Connect reflected cross-site scripting in methodOverride

CVE-2013-7371 · Severity: low · CVSS 3.1 · Published 2022-05-05

Node Connect is a popular middleware library for the Node.js web platform that handles request processing. The methodOverride middleware contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary JavaScript code into error pages. When a user submits a crafted HTTP request, the unsanitized input is echoed back in the 404 error response, enabling account hijacking, session theft, or malware distribution to application users.

Vendors: npm.

Quick answers

Is CVE-2013-7371 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2013-7371 being exploited in the wild.
How severe is CVE-2013-7371?: Low severity, with a CVSS score of 3.1, published 5 May 2022.
Which products and versions are affected?: connect (npm) SEMVER:introduced=0,fixed=2.8.2.
Is there a fix for CVE-2013-7371?: Yes. connect (npm): upgrade to 2.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2013-7371 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2013-7371?: Check whether you run connect (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

connect (npm): upgrade to 2.8.2 or later
```
npm install connect@2.8.2
```

Technical details

The vulnerability is a reflected XSS (CWE-79) in the methodOverride middleware, which allows HTTP POST requests to override the request method via the "_method" parameter or "x-http-method-override" header. The vulnerable code in proto.js line 155 constructs an error message ("Cannot [METHOD] [URL]") without properly escaping the req.method value, which comes directly from user input. An attacker can submit a POST request with _method=<script> content to trigger XSS in the 404 error page. The attack requires network access and user interaction (the victim must view the crafted response in a browser), but does not require authentication. The fix was implemented in version 2.8.2, which properly HTML-encodes the method value before rendering it in error responses.

Affected products

Sencha Labs Connect before 2.8.2

Identifiers

CVE-2013-7371
GHSA-6w62-83g6-rfhj

Timeline

2013-06-27: disclosed: Issue #831 opened on GitHub
2013: patched: Fix committed to senchalabs/connect repository
2022-05-05: advisory: GHSA-6w62-83g6-rfhj published
2019-12-11: other: CVE-2013-7371 published to NVD

References

https://github.com/senchalabs/connect/issues/831

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.