Vulnerability · Published Aug 20, 2024 · Assigned by GitHub_M
CVE-2024-41657GHSL-2024-035: Casdoor CORS misconfiguration
High 8.1
In plain English
A high-severity security flaw in casdoor from casdoor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Official description
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/casdoor/casdoor | no fix listed | GHSA-mchx-7j67-8mcf |
| Go | github.com/casdoor/casdoor | no fix listed | GO-2024-3087 |
Affected products (as reported)
Weakness: CWE-942 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N