CVE-2013-7370
published 2019-12-11CVE-2013-7370: node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.42%
70.0th percentile
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | connect | >= 0 < 2.8.1 | 2.8.1 |
| adobe | connect | >= 0 < 2.8.2 | 2.8.2 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | node-connect | < node-connect 3.0.0-1 (bookworm) | node-connect 3.0.0-1 (bookworm) |
| debian | node-connect | — | — |
| node-connect | node-connect | < 2.8.2 | 2.8.2 |
| node-connect | node-connect | >= 0 < 3.0.0-1 | 3.0.0-1 |
| node-connect | node-connect | >= 0 < 3.0.0-1 | 3.0.0-1 |
| node-connect | node-connect | >= 0 < 3.0.0-1 | 3.0.0-1 |
| node-connect | node-connect | >= 0 < 3.0.0-1 | 3.0.0-1 |
| node-connect | node-connect | >= 0 < 3.3.0-1 | 3.3.0-1 |
| opensuse | opensuse | — | — |
| redhat | openshift | — | — |
| sencha | connect | < 2.8.2 | 2.8.2 |
| sencha | connect | < 2.8.1 | 2.8.1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nodejs-connect: XSS via HTTP request with a crafted method containing JavaScript
vendor_redhat·2013-07-01·CVSS 6.1
CVE-2013-7370 [MEDIUM] CWE-79 nodejs-connect: XSS via HTTP request with a crafted method containing JavaScript
nodejs-connect: XSS via HTTP request with a crafted method containing JavaScript
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
Statement: This issue affects the versions of nodejs-connect as shipped with Red Hat OpenShift Enterprise 2. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: nodejs010-nodejs-connect (Red Hat OpenShift Enterprise 2) - Will not fix
Debian
CVE-2013-7371: node-connect - node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middl...
vendor_debian·2013·CVSS 6.1
CVE-2013-7371 [MEDIUM] CVE-2013-7371: node-connect - node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middl...
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Debian
CVE-2013-7370: node-connect - node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
vendor_debian·2013·CVSS 6.1
CVE-2013-7370 [MEDIUM] CVE-2013-7370: node-connect - node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
Scope: local
bookworm: resolved (fixed in 3.0.0-1)
bullseye: resolved (fixed in 3.0.0-1)
forky: resolved (fixed in 3.0.0-1)
sid: resolved (fixed in 3.0.0-1)
trixie: resolved (fixed in 3.0.0-1)
GHSA
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
ghsa·2022-05-05·CVSS 6.1
CVE-2013-7371 [MEDIUM] CWE-79 Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
node-connect before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
### Overview
Connect is a stack of middleware that is executed in order in each request.
The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".
Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot `[method]` `[url]`" content. The method was not properly encoded for output in the browser.
### Example
OSV
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
osv·2022-05-05·CVSS 6.1
CVE-2013-7371 [MEDIUM] Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
node-connect before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
### Overview
Connect is a stack of middleware that is executed in order in each request.
The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".
Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot `[method]` `[url]`" content. The method was not properly encoded for output in the browser.
### Example
GHSA
methodOverride Middleware Reflected Cross-Site Scripting in connect
ghsa·2020-08-31
CVE-2013-7370 [LOW] CWE-79 methodOverride Middleware Reflected Cross-Site Scripting in connect
methodOverride Middleware Reflected Cross-Site Scripting in connect
Connect is a stack of middleware that is executed in order in each request.
The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".
Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot `[method]` `[url]`" content. The method was not properly encoded for output in the browser.
###Example:
```
~ curl "localhost:3000" -d "_method="
Cannot /
```
## Recommendation
Update to the newest version of Connect or disable methodOverride. It is not possible to
OSV
methodOverride Middleware Reflected Cross-Site Scripting in connect
osv·2020-08-31
CVE-2013-7370 [LOW] methodOverride Middleware Reflected Cross-Site Scripting in connect
methodOverride Middleware Reflected Cross-Site Scripting in connect
Connect is a stack of middleware that is executed in order in each request.
The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".
Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot `[method]` `[url]`" content. The method was not properly encoded for output in the browser.
###Example:
```
~ curl "localhost:3000" -d "_method="
Cannot /
```
## Recommendation
Update to the newest version of Connect or disable methodOverride. It is not possible to
OSV
CVE-2013-7370: node-connect before 2
osv·2019-12-11·CVSS 6.1
CVE-2013-7370 [MEDIUM] CVE-2013-7370: node-connect before 2
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
OSV
CVE-2013-7371: node-connects before 2
osv·2019-12-11·CVSS 6.1
CVE-2013-7371 [MEDIUM] CVE-2013-7371: node-connects before 2
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2014/04/21/2http://www.openwall.com/lists/oss-security/2014/05/13/1https://access.redhat.com/security/cve/cve-2013-7370https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7370https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-7370https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scriptinghttps://security-tracker.debian.org/tracker/CVE-2013-7370http://www.openwall.com/lists/oss-security/2014/04/21/2http://www.openwall.com/lists/oss-security/2014/05/13/1https://access.redhat.com/security/cve/cve-2013-7370https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7370https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-7370https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scriptinghttps://security-tracker.debian.org/tracker/CVE-2013-7370
2019-12-11
Published