Authentication Bypass Affecting crumb package, versions <4.0.2
Snyk CVSS
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:crumb:20150213
- published 21 Jun 2017
- disclosed 12 Feb 2015
- credit Nicolas Jessel
How to fix?
Upgrade crumb to version 4.0.2 or higher.
Overview
crumb is CSRF crumb generation and validation plugin.
Affected versions of the package are vulnerable to Authentication Bypass. crumb does not validate the hostname while comparing a request origin against the whitelist, but rather compare http protocol alone. This opens a window for attackers to gain information by Man in the Middle (MitM) attacks.