Executive brief
hapi is a popular web framework for Node.js used to build applications and services. A vulnerability known as 'Rosetta-Flash' allows an attacker to bypass security restrictions that normally prevent websites from talking to each other. This could allow a malicious site to steal sensitive data from a user's session on a different domain if that domain uses hapi to serve certain types of data (JSONP).
Technical details
The hapi framework versions 6.1.0 and earlier are vulnerable to the Rosetta-Flash attack (CVE-2014-4671). This vulnerability occurs because JSONP endpoints do not sufficiently validate or prefix the callback parameter, allowing an attacker to craft a callback that is interpreted as a valid, malicious SWF (Flash) file. By forcing a victim's browser to load this 'Flash' file from the vulnerable domain, an attacker can bypass the Same-Origin Policy (SOP) and perform Cross-Site Request Forgery (CSRF) to exfiltrate sensitive data. The fix involves prepending JSONP responses with an empty comment '/**/' to break the Flash parser and setting 'X-Content-Type-Options: nosniff'.
Affected products
- hapijs hapi <= 6.1.0
Timeline
- 2014-07-08: disclosed: Vulnerability details and Rosetta-Flash technique published
- 2014-07-14: patched: Fix merged into hapi master branch
- 2020-08-31: advisory: GitHub Advisory published