Homepage
About Snyk

Rosetta-flash jsonp vulnerability Affecting hapi package, versions < 6.1.0

0.0
high

Snyk CVSS

    Attack Complexity High
    Confidentiality High
    Integrity High

    Threat Intelligence

    EPSS 1.53% (87th percentile)
Expand this section
NVD
4.3 medium
Expand this section
Red Hat
4.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID npm:hapi:20140708-1
  • published 8 Jul 2014
  • disclosed 8 Jul 2014
  • credit Michele Spagnuolo
Report a new vulnerability Found a mistake?

Introduced: 8 Jul 2014

CVE-2014-4671 Open this link in a new tab
CWE-942 Open this link in a new tab

How to fix?

Upgrade to the latest version of hapi.js

Overview

This description taken from the pull request provided by Patrick Kettner.

tl:dr - someone created a alphanum only swf converter, which means that they can in theory use it as a callback at a JSONP endpoint, and as a result, send data across domains.

Prepending callbacks with an empty inline comment breaks the flash parser, and prevents the issue. This is a fairly common solution currently being implemented by Google, Facebook, and GitHub.

Source: Node Security Project