GitHub Advisoryadvisory · RubyGems

GHSA-2j9c-9vmv-7m39 Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request

HIGH Published 2018-07-31 Modified 2023-09-05 Official page ↗
Aliases
CVE-2017-11173
Ecosystem
RubyGems
Packages
rack-cors
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Reviewed
2020-06-16

Affected packages

• RubyGems rack-cors: < 0.4.1 → fixed in 0.4.1

Description

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted `example.com` domain name and not the malicious `example.net` domain name, then `example.com.example.net` (as well as `example.com-example.net`) would be inadvertently allowed.

Related

Alias · CVE (1)

  • CVE-2017-11173 Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. vulnerability

References