XSS in Hackerone Sails Node Module
CVE-2016-10549
Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests to vulnerable hosts through cross site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. Note that this is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. The problem can be compounded when the cors `credentials` setting is not provided. At that point authenticated cross domain requests are possible.
EPSS: 0.006 (47.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Hackerone Sails Node Module — versions <=0.12.7
- Sailsjs Sails
Weakness classification (CWE)
Public proof-of-concept exploits
References
- support@hackerone.com (x_refsource_MISC, Vendor Advisory)
- support@hackerone.com (Third Party Advisory, x_refsource_MISC)
- support@hackerone.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2016-10549?
- CVE-2016-10549 is a medium-severity vulnerability in Hackerone Sails Node Module, classified under Improper Access Control. CVSS score: 4.4/10. Published 2018-05-31.
- How severe is CVE-2016-10549?
- Medium severity. CVSS v3 base score is 4.4 out of 10.
- Is CVE-2016-10549 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.