Cross-Origin Resource Sharing Misconfiguration in Hapi Framework

CVE-2015-9236

What is CVE-2015-9236?

The Hapi Framework prior to version 11.0.0 has a security misconfiguration regarding Cross-Origin Resource Sharing (CORS). This vulnerability allows for inconsistent CORS headers to be returned, leading to a situation where cross-origin requests can bypass restrictions intended to secure the application. Specifically, when CORS is enabled, if one route has it disabled and the request type is not a GET request, the OPTIONS preflight request may respond with the default CORS headers, creating a false sense of security. Consequently, the actual request bypasses the expected CORS checks, exposing the application to potential cross-origin attacks.

References