CVE-2017-11173 — Project Rack-cors vulnerability

8 documents5 sources
Severity
8.8HIGHNVD
EPSS
1.8%
top 17.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Rack-cors Project Rack-corsDebian Ruby-rack-corsDebian Linux
Timeline
PublishedJul 13
Latest updateJul 31

Description

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/ruby-rack-cors< ruby-rack-cors 0.4.1-1 (bookworm)
▶RubyGemsrack-cors_project/rack-cors< 0.4.1

Also affects: Debian Linux 9.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request↗2018-07-31
▶
GHSA
Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request↗2018-07-31
▶
OSV
CVE-2017-11173: Missing anchor in generated regex for rack-cors before 0↗2017-07-13
▶

📋Vendor Advisories

1
Debian
CVE-2017-11173: ruby-rack-cors - Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious ...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-11173 rubygem-rack-cors: Missing anchor in generated regex in rack/cors.rb#L256 may permit forged malicious requests [fedora-all]↗2017-07-13
▶
Bugzilla
CVE-2017-11173 rubygem-rack-cors: Missing anchor in generated regex in rack/cors.rb#L256 may permit forged malicious requests [epel-all]↗2017-07-13
▶
Bugzilla
CVE-2017-11173 rubygem-rack-cors: Missing anchor in generated regex in rack/cors.rb#L256 may permit forged malicious requests↗2017-07-13
▶
CVE-2017-11173 — Project Rack-cors vulnerability | cvebase