Executive brief
crumb is a Node.js library that provides CSRF protection tokens for web applications built with the hapi framework. A CORS (Cross-Origin Resource Sharing) misconfiguration allows an attacker to retrieve CSRF tokens intended for other domains by tricking users into visiting an attacker-controlled site, potentially enabling unauthorized requests to protected endpoints.
Technical details
The vulnerability is a token disclosure issue (CWE-284) in crumb's CORS handling. When CORS is enabled on a route handler, the library improperly allows setting CSRF tokens for different domains. An attacker can exploit this by hosting a malicious site that requests a CORS-enabled route, retrieving the crumb token in the response. This token can then be reused for forged requests to non-CORS endpoints as the victim user. The attack requires CORS to be enabled on at least one route and the victim to visit attacker-controlled content; most real-world configurations use either global CORS (where crumb is typically disabled) or no CORS at all, making exploitation scenarios unlikely. The fix was released in version 3.0.0.
Affected products
- hapi crumb < 3.0.0
Timeline
- 2014-12-25: disclosed: CVE-2014-7193 published
- 2014-07-31: patched: Security fix merged in commit 5e6d4f5
- 2017-10-24: advisory: GitHub advisory GHSA-84fq-6626-w5fg published