PT-2019-7013 · Node.Js · Node-Connect

Kurt Seifried · Published 2019-12-11 · Updated 2020-08-31 · CVE-2013-7370

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions node-connect versions prior to 2.8.1

Description The issue arises from the "methodOverride" middleware in Connect, which allows HTTP POST requests to override the method of the request using the method post key or the x-http-method-override header. Since user post input is not properly checked, req.method can contain any value. When this value does not match common method verbs, Connect responds with a 404 page containing the "Cannot [method] [url]" content, where the method is not properly encoded for browser output. This can lead to XSS attacks, as demonstrated by an example where a malicious script is injected through the method parameter.

Recommendations Update to the newest version of Connect. Disable the methodOverride middleware to prevent exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-7370

GHSA-3FW8-66WF-PR7M

Affected Products

Node-Connect

References · 18

• https://security-tracker.debian.org/tracker/CVE-2013-7370 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3fw8-66wf-pr7m · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7370 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-7370 · Security Note
• http://openwall.com/lists/oss-security/2014/04/21/2 · Patch
• https://ubuntu.com/security/CVE-2013-7370 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-7370 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7370 · Vendor Advisory
• https://github.com/senchalabs/connect/commit/126187c4e12162e231b87350740045e5bb06e93a · Note
• https://github.com/senchalabs/connect/issues/831 · Note
• https://github.com/senchalabs/connect/commit/277e5aad6a95d00f55571a9a0e11f2fa190d8135 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7370 · Note
• https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting · Note
• http://openwall.com/lists/oss-security/2014/05/13/1 · Note