GHSA-583g-g682-crxf

First published: Fri Feb 09 2024(Updated: )

### Summary Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought. ### Details A malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are ["simple"](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests) and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered. ### Impact Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/github-advisory-latest
• source/GitHub
• alias/GHSA-583g-g682-crxf
• alias/CVE-2024-23639
• agent/software-canonical-lookup
• agent/weakness
• agent/last-modified-date
• agent/references
• agent/severity
• agent/type
• agent/description
• agent/softwarecombine
• agent/first-publish-date
• agent/event
• agent/tags
• collector/github-advisory
• package-manager/maven