CVE-2018-20744

Vulnerability

The Olivier Poitrey Go CORS handler library (rs/cors) through version 1.3.0 contains a security flaw where configuring Access-Control-Allow-Origin to * (wildcard) causes the handler to actively reflect any arbitrary Origin header value from the request, rather than respecting the standard behavior. This misbehavior goes against the CORS specification, which dictates that * should match any origin without reflecting it. The library prints a warning but still performs the reflection. [2][3]

Exploitation

An attacker can send a request with a crafted Origin header (e.g., https://attacker.com) to a server using the vulnerable library with a wildcard CORS policy. The server will include that arbitrary origin in the Access-Control-Allow-Origin response header. No authentication or special privileges are required; the attacker only needs to be able to send HTTP requests to the target server.

Impact

By reflecting an arbitrary origin, the server effectively allows any website to make cross-origin requests to it. This can lead to unauthorized data access or actions on behalf of users if the server relies on CORS for security. In the presence of credentials (e.g., cookies), the impact amplifies because the browser will enforce the reflected origin, potentially enabling cross-origin read or write attacks. [3]

Mitigation

The issue was fixed in the rs/cors library by pull request #57, which made the * behavior standards-compliant. Users should upgrade to a version after 1.3.0 (the fixed version is not explicitly stated, but the PR was merged). Alternatively, users can avoid using the * wildcard and instead explicitly list allowed origins. [4]