Open Proxy Misconfiguration in CORS-Anywhere by Rob W

CVE-2020-36851

What is CVE-2020-36851?

The CORS-Anywhere project has a misconfiguration that allows unauthorized external users to exploit the service as an open proxy. This vulnerability leads to Server-Side Request Forgery (SSRF) attacks, enabling attackers to induce the proxy to issue HTTP requests to arbitrary internal targets. Such exploitation can result in unauthorized access to sensitive metadata services, internal APIs, and cloud resources. Attackers can craft requests to retrieve sensitive data – including cloud credentials – and may execute arbitrary code or escalate privileges depending on exposed backend services. Protect against this vulnerability by implementing authentication, restrict proxy usage to trusted origins, whitelisting target hosts, and applying network-level security measures.

References