~ / search / GHSA-2j9c-9vmv-7m39

GHSA-2j9c-9vmv-7m39

Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request

Source: GitHub Advisory Database (reviewed) High CVE-2017-11173

Packages

EcosystemPackageAffectedFixed in
RubyGems rack-cors < 0.4.1 0.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted `example.com` domain name and not the malicious `example.net` domain name, then `example.com.example.net` (as well as `example.com-example.net`) would be inadvertently allowed.

References

External links from the advisory. They lead to third-party sites.