CVE-2021-39185: Vulnerability in org.http4s:http4s-server - Default CORS config allows any origin with credentials
Summary
CVE-2021-39185: Default CORS config allows any origin with credentials. Affects org.http4s:http4s-server across 3 version ranges.
< 0.21.27
>= 0.22.0, < 0.22.3
>= 0.23.0, < 0.23.2
Fixed in 0.21.27, 0.22.3 or 0.23.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.http4s:http4s-server package is an open-source library for building HTTP servers in Scala. It provides functionality for handling HTTP requests and responses, routing, and middleware. The package is widely used in Scala applications for server-side development. However, a vulnerability has been identified in the default CORS (Cross-Origin Resource Sharing) configuration of the package, which allows any origin to access sensitive information with credentials.
Vulnerability Detail
The default CORS configuration in org.http4s:http4s-server is vulnerable to an origin reflection attack and a null origin attack. This means that an attacker can send a malicious request from a different origin and retrieve sensitive information that should only be accessible to trusted origins. The vulnerability arises from the combination of the 'anyOrigin' flag being set to 'true' and the 'allowCredentials' flag being set to 'true' in the default configuration. This allows the server to share responses that may contain sensitive information with any origin, including malicious ones. An attacker can exploit this vulnerability to exfiltrate sensitive information with the user's credentials. Additionally, the middleware is susceptible to a null origin attack, where a request from a sandboxed iframe with 'Origin: null' is allowed, enabling the exfiltration of secrets.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.21.270.21.27 -
>= 0.22.0, < 0.22.30.22.3 -
>= 0.23.0, < 0.23.20.23.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the patched versions is not immediately feasible, there are workarounds to mitigate the vulnerability. One approach is to explicitly specify trusted origins and set the 'anyOrigin' flag to 'false' in the CORS configuration. For versions 0.21.x, the configuration can be set as follows:
val routes: HttpRoutes[F] = ???
val config = CORS.DefaultConfig.copy(
anyOrigin = false,
allowOrigins = Set("http://trusted.example.com")
)
val cors = CORS(routes, config)
For versions 0.22.x, 0.23.x, and 1.x, the configuration can be set as follows:
val routes: HttpRoutes[F] = ???
val config = CORSConfig.default
.withAnyOrigin(false)
.withAllowedOrigins(Set("http://trusted.example.com"))
val cors = CORS(routes, config)
Another workaround is to disable sharing responses tainted by credentials. This can be achieved by setting the 'allowCredentials' flag to 'false' in the CORS configuration. For versions 0.21.x, the configuration can be set as follows:
val routes: HttpRoutes[F] = ???
val config = CORS.DefaultConfig.copy(allowCredentials = false)
val cors = CORS(routes, config)
For versions 0.22.x, 0.23.x, and 1.x, the configuration can be set as follows:
val routes: HttpRoutes[F] = ???
val config = CORSConfig.default.withAllowedCredentials(false)
val cors = CORS(routes, config)
Conclusion
The org.http4s:http4s-server package is vulnerable to an origin reflection attack and a null origin attack due to the default CORS configuration. To mitigate this vulnerability, it is recommended to update to the patched versions of the package and adjust the CORS configuration accordingly. Workarounds are available if immediate updates are not feasible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.http4s:http4s-server →
FAQ
The vulnerability allows an attacker to access sensitive information from a server that is using the org.http4s:http4s-server package with the default CORS configuration. This information can include passwords or other confidential data. The attacker can exploit the vulnerability by sending a malicious request from a different origin and exfiltrating the sensitive information with the user's credentials.
To fix this vulnerability, it is recommended to update to the patched versions of the org.http4s:http4s-server package. The problem has been fixed in versions 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The new versions introduce a new CORS configuration approach using the 'CORSPolicy' object. It is advised to migrate to the new version and update the CORS configuration accordingly.
Yes, there are workarounds available to mitigate the vulnerability if updating to the patched versions is not immediately feasible. One workaround is to explicitly specify trusted origins and set the 'anyOrigin' flag to 'false' in the CORS configuration. Another workaround is to disable sharing responses tainted by credentials by setting the 'allowCredentials' flag to 'false' in the CORS configuration.
If this vulnerability is not fixed, an attacker can continue to exploit the default CORS configuration of the org.http4s:http4s-server package to access sensitive information from the server. This can lead to unauthorized access to confidential data and potential misuse of user credentials.
You can refer to the MDN guide to CORS (Cross-Origin Resource Sharing) for more information. It provides detailed explanations and examples of how CORS works and how to properly configure it to ensure secure communication between origins.
Related vulnerabilities
Recent vulnerabilities recorded for org.http4s:http4s-server.
