CORS Request Vulnerability in Rack-CORS by Cyu

CVE-2017-11173

What is CVE-2017-11173?

A significant security flaw in rack-cors versions prior to 0.4.1 stems from a missing anchor in the generated regular expression. This oversight permits malicious third-party sites to execute CORS requests, potentially allowing access to resources from domains that were not intended to be allowed by the application. For instance, if a particular configuration is set to accept requests solely from the trusted example.com, unintended domains such as example.com.example.net and example.com-example.net could gain unauthorized access, exposing application resources to harmful exploitation.

References