CVE-2015-9243 Unsafe Merging of CORS Configuration Conflict in hapi
Attackers can bypass CORS restrictions in hapi node module when multiple configuration levels are combined, allowing unauthorized cross-origin requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-9243?
CVE-2015-9243 is a medium-severity vulnerability in HackerOne hapi node module, published on 29 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).
Which versions are affected by CVE-2015-9243?
2 open source packages ship an affected version, including hapi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hapi npm | All versions | 11.1.4 |
hapi npm | All versions | 11.1.4 |
Products include Hapijs Hapi.
How do I fix CVE-2015-9243?
Upgrade hapi to 11.1.4 or later.
Is CVE-2015-9243 being exploited?
There is no known exploitation of CVE-2015-9243 in the wild and no public exploit code.
Other vulnerabilities in HackerOne hapi node module
Sources
Also known as GHSA-j3g2-m5jj-6336.