PT-2023-31361 · Npm · @Koa/Cors
Pawelj-Pl
·
Publicado
2023-12-11
·
Atualizado
2023-12-14
·
CVE-2023-49803
CVSS v3.1
8.6
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
@koa/cors versions prior to 5.0.0
Description
The @koa/cors middleware for the koa web framework in Node.js has a security issue where it returns an
Access-Control-Allow-Origin header with the value of the origin from the request if an allowed origin is not provided. This behavior disables the Same Origin Policy (SOP), a crucial browser security element, potentially causing serious security threats to users. The issue is particularly concerning if users are not aware of the risks associated with this behavior, especially when used in production applications.Recommendations
For versions prior to 5.0.0, update to version 5.0.0 to fix the vulnerability. As a temporary workaround, consider emphasizing the risks associated with the current behavior in the documentation, especially for users who may not be aware of the security implications. If the middleware is used exclusively for prototypes and not for production applications, it is essential to indicate the expected behavior and associated risks clearly in the documentation.
Exploit
Correção
Origin Validation Error
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
@Koa/Cors