PT-2017-11796 · Ruby · Rack-Cors

Jens Mueller · Published 2017-07-13 · Updated 2020-03-03 · CVE-2017-11173

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rack-cors versions prior to 0.4.1

Description The issue allows a malicious third-party site to perform CORS requests due to a missing anchor in the generated regex. This could lead to unintended domains being allowed if the configuration is set to trust specific domain names. For instance, if the configuration is intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.

Recommendations For versions prior to 0.4.1, update to version 0.4.1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2017-11173

DSA-3931-1

GHSA-2J9C-9VMV-7M39

Affected Products

Rack-Cors

References · 13

• https://github.com/cyu/rack-cors/commit/42ebe6caa8e85ffa9c8a171bda668ba1acc7a5e6 · Patch
• http://debian.org/security/2017/dsa-3931 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11173 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2j9c-9vmv-7m39 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11173 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-11173 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-11173 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-11173 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-11173 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-11173 · Vendor Advisory
• https://github.com/cyu/rack-cors · Note
• https://packetstormsecurity.com/files/143345/rack-cors-Missing-Anchor.html · Note
• http://seclists.org/fulldisclosure/2017/Jul/22 · Note