PT-2019-7013 · Node.Js · Node-Connect

Kurt Seifried · Publicado 2019-12-11 · Atualizado 2020-08-31 · CVE-2013-7370

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions node-connect versions prior to 2.8.1

Description The issue arises from the "methodOverride" middleware in Connect, which allows HTTP POST requests to override the method of the request using the method post key or the x-http-method-override header. Since user post input is not properly checked, req.method can contain any value. When this value does not match common method verbs, Connect responds with a 404 page containing the "Cannot [method] [url]" content, where the method is not properly encoded for browser output. This can lead to XSS attacks, as demonstrated by an example where a malicious script is injected through the method parameter.

Recommendations Update to the newest version of Connect. Disable the methodOverride middleware to prevent exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-7370

GHSA-3FW8-66WF-PR7M

Produtos afetados

Node-Connect

Referências · 18

• https://github.com/senchalabs/connect/commit/126187c4e12162e231b87350740045e5bb06e93a · Nota
• https://github.com/senchalabs/connect/issues/831 · Nota
• https://github.com/senchalabs/connect/commit/277e5aad6a95d00f55571a9a0e11f2fa190d8135 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-7370 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7370 · Nota
• https://osv.dev/vulnerability/GHSA-3fw8-66wf-pr7m · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7370 · Aviso do Fabricante
• https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting · Nota
• http://openwall.com/lists/oss-security/2014/05/13/1 · Nota
• https://npmjs.com/advisories/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-7370 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2013-7370 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/04/21/2 · Correção
• https://ubuntu.com/security/CVE-2013-7370 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-7370 · Aviso do Fabricante