PT-2025-39389 · WordPress · Cors-Anywhere

Jonathan Leitschuh · Published 2025-09-25 · Updated 2026-05-26 · CVE-2020-36851

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions cors-anywhere (affected versions not specified)

Description Instances of cors-anywhere configured as an open proxy permit unauthenticated external users to initiate HTTP requests to arbitrary targets, leading to Server-Side Request Forgery (SSRF). The proxy forwards requests and headers, potentially granting access to internal-only endpoints and link-local metadata services. This can result in the retrieval of instance role credentials or other sensitive metadata, and interaction with internal APIs and services. Exploitation involves sending crafted requests to the proxy with the target resource encoded in the URL. Deployments that forward arbitrary methods and headers, including PUT, may allow exploitation of IMDSv2 workflows and access to internal management APIs. Successful exploitation can lead to theft of cloud credentials, unauthorized access to internal services, remote code execution, privilege escalation, data exfiltration, and full compromise of cloud resources.

Recommendations Restrict the proxy to trusted origins or require authentication. Whitelist allowed target hosts. Prevent access to link-local and internal IP ranges. Remove support for unsafe HTTP methods and headers. Enable cloud provider mitigations. Deploy network-level protections.

Fix

LPE

RCE

SSRF

Weakness Enumeration

CWE-942

CWE-918

Related Identifiers

CVE-2020-36851

GHSA-9WMG-93PW-FC3G

GHSA-R3JV-XFGX-GJ24

Affected Products

Cors-Anywhere

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2020-36851 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36851 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r3jv-xfgx-gj24 · Vendor Advisory
• https://github.com/Rob--W/cors-anywhere/issues/521 · Note
• https://github.com/Rob--W/cors-anywhere/issues/78 · Note
• https://github.com/Rob--W/cors-anywhere/issues/152 · Note
• https://github.com/Rob--W/cors-anywhere · Note
• https://vulncheck.com/advisories/rob-w-cors-anywhere-misconfigured-cors-proxy-allows-ssrf · Note
• https://t.me/cveNotify/136404 · Telegram Post
• https://certik.com/resources/blog/cors-anywhere-dangers-of-misconfigured-third-party-software · Note
• https://t.me/cveNotify/136471 · Telegram Post
• https://github.com/SocketDev/security-research/security/advisories/GHSA-9wmg-93pw-fc3g · Note
• https://twitter.com/CveFindCom/status/1971230822662291704 · Twitter Post
• https://t.me/CVEtracker/33330 · Telegram Post
• https://twitter.com/CVEnew/status/1971226582787510632 · Twitter Post