CVE-2009-2816: CSRF
A security flaw was found in the WebKit's Cross-Origin Resource Sharing (CORS) implementation. Quoting exact details from the WebKit advisory:
Before allowing a page from one origin to access a resource in another origin, WebKit sends a preflight request, to determine if the origin server for the resource being accessed will allow the resource to be shared. WebKit includes custom HTTP headers specified by the requesting page in the preflight request. This can result in unexpected actions being initiated on the cross-origin site without user consent. This issue is addressed by dropping custom HTTP headers from preflight requests.
Upstream bug: ------------- https://bugs.webkit.org/showbug.cgi?id=28446
Upstream patch: --------------- http://trac.webkit.org/changeset/47494
Other sources
The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2816?
CVE-2009-2816 is classified as a moderate severity vulnerability due to its potential impact on cross-origin resource sharing.
How do I fix CVE-2009-2816?
To mitigate CVE-2009-2816, update your browser or operating system to the latest version provided by the vendor.
Which versions are affected by CVE-2009-2816?
CVE-2009-2816 affects older versions of Apple Safari, Google Chrome, Apple iPhone OS, and specific releases of openSUSE and Fedora.
What types of applications are impacted by CVE-2009-2816?
CVE-2009-2816 primarily impacts web applications that utilize cross-origin resource sharing (CORS) features.
Can CVE-2009-2816 lead to data breaches?
Yes, CVE-2009-2816 can potentially expose sensitive data by allowing unauthorized access to resources from different origins.