Is CVE-2014-4671 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2014-4671 being exploited in the wild.

How severe is CVE-2014-4671?

Informational severity, with a CVSS score of 4.3, published 31 August 2020.

Which products and versions are affected?

hapi (npm) SEMVER:introduced=0,fixed=6.1.0.

Is there a fix for CVE-2014-4671?

Yes. hapi (npm): upgrade to 6.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2014-4671 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2014-4671?

Check whether you run hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2014-4671: hapijs hapi Rosetta-Flash JSONP vulnerability

CVE-2014-4671 · Severity: info · CVSS 4.3 · Published 2020-08-31

hapi is a popular web framework for Node.js used to build applications and services. A vulnerability known as 'Rosetta-Flash' allows an attacker to bypass security restrictions that normally prevent websites from talking to each other. This could allow a malicious site to steal sensitive data from a user's session on a different domain if that domain uses hapi to serve certain types of data (JSONP).

Technologies: hapi (npm). Vendors: npm.

Quick answers

Is CVE-2014-4671 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2014-4671 being exploited in the wild.
How severe is CVE-2014-4671?: Informational severity, with a CVSS score of 4.3, published 31 August 2020.
Which products and versions are affected?: hapi (npm) SEMVER:introduced=0,fixed=6.1.0.
Is there a fix for CVE-2014-4671?: Yes. hapi (npm): upgrade to 6.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2014-4671 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2014-4671?: Check whether you run hapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hapi (npm): upgrade to 6.1.0 or later
```
npm install hapi@6.1.0
```

Technical details

The hapi framework versions 6.1.0 and earlier are vulnerable to the Rosetta-Flash attack (CVE-2014-4671). This vulnerability occurs because JSONP endpoints do not sufficiently validate or prefix the callback parameter, allowing an attacker to craft a callback that is interpreted as a valid, malicious SWF (Flash) file. By forcing a victim's browser to load this 'Flash' file from the vulnerable domain, an attacker can bypass the Same-Origin Policy (SOP) and perform Cross-Site Request Forgery (CSRF) to exfiltrate sensitive data. The fix involves prepending JSONP responses with an empty comment '/**/' to break the Flash parser and setting 'X-Content-Type-Options: nosniff'.

Affected products

hapijs hapi <= 6.1.0

Identifiers

CVE-2014-4671
GHSA-363h-vj6q-3cmj

Timeline

2014-07-08: disclosed: Vulnerability details and Rosetta-Flash technique published
2014-07-14: patched: Fix merged into hapi master branch
2020-08-31: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.