Necrotizing Pineapple Music
sails

Broken CORS

Severity: high

Overview

Affected versions of sails have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy.

Mitigating Factors

This is only an issue when allRoutes is set to true and origin is set to * or left commented out in the sails CORS config file.

The problem can be compounded when the cors credentials setting is not provided, because at that point authenticated cross domain requests are possible.

Remediation

Update to version 0.12.7 or later.

As this vulnerability is primarily a user error, the patch for the vulnerability will simply cause the application to write an error message to the console when a vulnerable configuration is used in a production environment.

Writing a proper CORS configuration is still the responsibility of the user, so it is necessary to check for the error message after installing the patch. Be sure you are not using allRoutes: true with origin:'*', and that you uncomment origin and set it to a reasonable value. Ensure that if origin is set to * that you truly mean for all other websites to be able to make cross-domain requests to your API.

Likewise, ensure credentials is uncommented out and set to the appropriate value. Make sure to explicitly set which origins may request resources via CORS.

Vulnerable versions

0.0.0
6 years ago
0.7.0
6 years ago
0.7.1
6 years ago
0.7.2
6 years ago
0.7.3
6 years ago
0.7.4
6 years ago
0.7.7
6 years ago
0.7.8
6 years ago
0.7.9
6 years ago
0.8.0
6 years ago
0.8.1
6 years ago
0.8.2
5 years ago
0.8.3
5 years ago
0.8.4
5 years ago
0.8.5
5 years ago
0.8.6
5 years ago
0.8.7
5 years ago
0.8.71
5 years ago
0.8.72
5 years ago
0.8.73
5 years ago
0.8.74
5 years ago
0.8.75
5 years ago
0.8.76
5 years ago
0.8.77
5 years ago
0.8.78
5 years ago
0.8.79
5 years ago
0.8.80
5 years ago
0.8.81
5 years ago
0.8.82
5 years ago
0.8.83
5 years ago
0.8.84
5 years ago
0.8.85
5 years ago
0.8.86
5 years ago
0.8.87
5 years ago
0.8.88
5 years ago
0.8.89
5 years ago
0.8.892
5 years ago
0.8.893
5 years ago
0.8.894
5 years ago
0.8.895
5 years ago
0.8.9
5 years ago
0.8.91
5 years ago
0.8.92
5 years ago
0.8.93
5 years ago
0.8.94
5 years ago
0.9.0
5 years ago
0.9.1
5 years ago
0.9.2
5 years ago
0.9.3
5 years ago
0.9.4
5 years ago
0.9.7
5 years ago
0.9.5
5 years ago
0.9.8
5 years ago
0.9.9
5 years ago
0.9.11
4 years ago
0.9.12
4 years ago
0.9.13
4 years ago
0.9.14
4 years ago
0.9.15
4 years ago
0.9.16
4 years ago
0.9.17
4 years ago
0.10.1
4 years ago
0.10.2
4 years ago
0.10.3
4 years ago
0.10.4
4 years ago
0.10.5
4 years ago
0.11.0
4 years ago
0.11.1
3 years ago
0.11.2
3 years ago
0.11.3
3 years ago
0.11.4
3 years ago
0.11.5
3 years ago
0.12.0
3 years ago
0.12.1
3 years ago
0.12.2
2 years ago
0.12.3
2 years ago
0.12.4
2 years ago
0.12.5
2 years ago
0.12.6
2 years ago
0.12.7
2 years ago

Unaffected versions

0.0.0-1
6 years ago
0.0.0-2
6 years ago
0.7.0-2
6 years ago
0.7.0-3
6 years ago
0.7.0-4
6 years ago
0.7.0-5
6 years ago
0.7.0-6
6 years ago
0.7.0-7
6 years ago
0.7.0-8
6 years ago
0.7.4-1
6 years ago
0.7.5-0
6 years ago
0.7.6-0
6 years ago
0.8.89-1
5 years ago
0.10.0-rc1
4 years ago
0.10.0-rc2
4 years ago
0.10.0-rc3
4 years ago
0.10.0-rc4
4 years ago
0.10.0-rc5
4 years ago
0.10.0-rc6
4 years ago
0.10.0-rc7
4 years ago
0.10.0-rc8
4 years ago
0.10.0-rc9
4 years ago
0.10.0-max
4 years ago
0.10.0-rc10
4 years ago
0.10.0-rc11
4 years ago
0.11.0-rc2
4 years ago
0.11.0-rc3
4 years ago
0.11.0-rc4
4 years ago
0.11.0-rc5
4 years ago
0.11.0-rc6
4 years ago
0.11.0-rc7
4 years ago
0.11.0-rc8
4 years ago
0.11.0-rc9
4 years ago
0.11.0-rc10
4 years ago
0.11.1-rc1
3 years ago
0.12.0-rc1
3 years ago
0.12.0-rc2
3 years ago
0.12.0-rc3
3 years ago
0.12.0-rc4
3 years ago
0.12.0-rc5
3 years ago
0.12.0-rc6
3 years ago
0.12.0-rc7
3 years ago
0.12.0-rc8
3 years ago
0.12.0-rc9
3 years ago
0.12.1-rc1
3 years ago
0.12.1-deprecatedDepExperiment
2 years ago
0.12.2-0
2 years ago
0.11.6-0
2 years ago
0.11.6-1
2 years ago
0.12.4-rc1
2 years ago
0.12.4-rc2
2 years ago
0.12.4-rc3
2 years ago
1.0.0-0
2 years ago
1.0.0-1
2 years ago
1.0.0-2
2 years ago
1.0.0-3
2 years ago
1.0.0-4
2 years ago
1.0.0-5
2 years ago
0.12.8
2 years ago
1.0.0-6
2 years ago
1.0.0-7
2 years ago
1.0.0-8
2 years ago
0.12.9
2 years ago
1.0.0-9
2 years ago
1.0.0-10
2 years ago
1.0.0-11
2 years ago
0.12.10-0
2 years ago
0.12.10-1
2 years ago
1.0.0-12
2 years ago
0.12.10
2 years ago
1.0.0-13
2 years ago
0.12.11-0
2 years ago
1.0.0-14
2 years ago
0.12.11-1
2 years ago
0.12.11
2 years ago
1.0.0-15
2 years ago
1.0.0-16
2 years ago
1.0.0-17
2 years ago
1.0.0-18
2 years ago
1.0.0-19
2 years ago
1.0.0-20
2 years ago
0.12.12-1
2 years ago
1.0.0-21
2 years ago
1.0.0-22
2 years ago
1.0.0-23
a year ago
1.0.0-24
a year ago
1.0.0-25
a year ago
1.0.0-26
a year ago
1.0.0-27
a year ago
1.0.0-28
a year ago
0.12.12-2
a year ago
0.12.12-3
a year ago
0.12.12
a year ago
1.0.0-29
a year ago
1.0.0-30
a year ago
0.12.13
a year ago
1.0.0-31
a year ago
1.0.0-32
a year ago
1.0.0-33
a year ago
1.0.0-34
a year ago
1.0.0-35
a year ago
1.0.0-36
a year ago
1.0.0-37
a year ago
0.12.14
a year ago
1.0.0-38
10 months ago
1.0.0-39
9 months ago
1.0.0-40
9 months ago
1.0.0-41
9 months ago
1.0.0-42
8 months ago
1.0.0-44
8 months ago
1.0.0-45
8 months ago
1.0.0-46
6 months ago
1.0.0-47
5 months ago
1.0.0-48
5 months ago
1.0.0-49
5 months ago
1.0.0
5 months ago
1.0.1
4 months ago
1.0.2
3 months ago
1.0.3-0
3 months ago
1.0.3-1
3 months ago
1.0.3-2
3 months ago
1.0.3-3
23 days ago
1.0.3-4
22 days ago
1.1.0-1
13 days ago
1.1.0-2
13 days ago

Advisory timeline

  1. Published

    Advisory published
    Oct 20th, 2016
  2. Reported

    Initial report by Evan Johnson
    Oct 5th, 2016