Executive brief
hapi is a popular Node.js web application framework. Versions prior to 11.0.0 incorrectly implement Cross-Origin Resource Sharing (CORS) security controls, allowing requests that should be blocked by CORS policies to proceed. An attacker can exploit inconsistent CORS header handling to bypass cross-origin restrictions and perform unauthorized actions from malicious websites against applications using vulnerable hapi versions.
Technical details
The vulnerability stems from incorrect CORS implementation in hapi prior to version 11.0.0. When a connection has CORS enabled globally but a specific route has it disabled (and the route method is not GET), the OPTIONS preflight request incorrectly returns default CORS headers, while the subsequent actual request returns no CORS headers. This inconsistency allows browser-based attackers to bypass CORS restrictions through HTTP preflight handling. The attack requires the attacker to trick a user's browser into making cross-origin requests to a vulnerable hapi application, but no authentication is required. The fix is to update to hapi version 11.0.0 or later, which properly handles route-specific CORS overrides and consistency between preflight and actual request responses.
Affected products
- hapi hapi before 11.0.0
Timeline
- 2015-10-14: disclosed
- 2015: patched: Fix released in version 11.0.0
- 2018-06-07: advisory