PT-2023-31361 · Npm · @Koa/Cors

Pawelj-Pl

·

Published

2023-12-11

·

Updated

2023-12-14

·

CVE-2023-49803

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions @koa/cors versions prior to 5.0.0
Description The @koa/cors middleware for the koa web framework in Node.js has a security issue where it returns an Access-Control-Allow-Origin header with the value of the origin from the request if an allowed origin is not provided. This behavior disables the Same Origin Policy (SOP), a crucial browser security element, potentially causing serious security threats to users. The issue is particularly concerning if users are not aware of the risks associated with this behavior, especially when used in production applications.
Recommendations For versions prior to 5.0.0, update to version 5.0.0 to fix the vulnerability. As a temporary workaround, consider emphasizing the risks associated with the current behavior in the documentation, especially for users who may not be aware of the security implications. If the middleware is used exclusively for prototypes and not for production applications, it is essential to indicate the expected behavior and associated risks clearly in the documentation.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2023-49803
GHSA-QXRJ-HX23-XP82

Affected Products

@Koa/Cors