methodOverride Middleware Reflected Cross-Site Scripting in connect

Description

Connect is a stack of middleware that is executed in order in each request.

The “methodOverride” middleware allows the http post to override the method of the request with the value of the “_method” post key or with the header “x-http-method-override”.

Because the user post input was not checked, req.method could contain any kind of value.

Recommendation

Update the connect package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.8.0
• Patched version(s): 2.8.1

References

• GHSA-3fw8-66wf-pr7m
• access.redhat.com
• bugzilla.redhat.com
• bugzilla.suse.com
• security-tracker.debian.org
• www.npmjs.com
• www.openwall.com
• CVE-2013-7370
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware - CVE-2013-7371
• Cross-Site Scripting in react (GHSA-g53w-52xc-2j85) - CVE-2013-7035
• jplayer Cross Site Scripting vulnerability - CVE-2013-2022
• Cross-Site Scripting in connect - CVE-2018-3717

Tags:

npm

connect