Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Hapijs |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2018-0202 | Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route. |
 Github GHSA |
GHSA-vwrf-r5r4-7775 | Incorrect handling of CORS preflight request headers in hapi |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2024-09-17T04:15:13.448Z
Reserved: 2017-10-29T00:00:00
Link: CVE-2015-9236
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-05-31T20:29:00.360
Modified: 2024-11-21T02:40:07.240
Link: CVE-2015-9236
Redhat
No data.
OpenCVE Enrichment
No data.