CVE-2024-41657 GHSL-2024-035: Casdoor CORS misconfiguration

2024-08-2020:11:29

CWE-942

GitHub_M

www.cve.org

casdoor

cors misconfiguration

cross domain requests

beego filter

logic vulnerability

authentication loophole

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

38.0%

JSON

Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.

CNA Affected

[
  {
    "vendor": "casdoor",
    "product": "casdoor",
    "versions": [
      {
        "version": "<= 1.577.0",
        "status": "affected"
      }
    ]
  }
]