CVE-2024-41657: GHSL-2024-035_GHSL-2024-036: CORS misconfguration and Reflected XSS in Casdoor - CVE-2024-41657, CVE-2024-41658
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.
Other sources
Casdoor is vulnerable to a CORS misconfiguration and a reflected Cross-Site Scripting (XSS) vulnerability, both of which may allow an attacker to take actions on behalf of the signed-in user.
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41657?
CVE-2024-41657 has been assessed as a moderate severity vulnerability due to its potential for cross-domain request exploitation.
How do I fix CVE-2024-41657?
To fix CVE-2024-41657, upgrade Casdoor to version 1.577.1 or later where the logic vulnerability in the CorsFilter has been addressed.
What systems are affected by CVE-2024-41657?
CVE-2024-41657 affects Casdoor versions 1.577.0 and earlier.
What type of vulnerability is CVE-2024-41657?
CVE-2024-41657 is a logic vulnerability within the CorsFilter that allows unauthorized cross-domain requests.
Can CVE-2024-41657 lead to unauthorized access?
Yes, CVE-2024-41657 may allow attackers to make requests as an authenticated user, potentially leading to unauthorized access.