GHSA-6cqp-g7gg-8hr5 — Netty: Security Control Bypass via CORS Short-Circuit Failure

Affected: Maven: io.netty:netty-codec-http

### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an `Origin: null` header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls.

### Details In `io.netty.handler.codec.http.cors.CorsHandler#channelRead`, the short-circuit logic relies on the configuration returned by `getForOrigin(origin)` to determine if an origin is authorized. If `getForOrigin` returns a configuration object, the short-circuit check `(!(origin == null || config != null))` is bypassed, and the request proceeds to the backend.

The vulnerability is located in the `getForOrigin` method:

```java if (corsConfig.isNullOriginAllowed() || NULL_ORIGIN.equals(requestOrigin)) { return corsConfig; } ```

If an attacker sends `Origin: null`, `NULL_ORIGIN.equals(requestOrigin)` evaluates to true. The method returns the configuration object regardless of whether `isNullOriginAllowed()` was configured by the developer. The short-circuit is bypassed.

### Impact Applications relying on CorsHandler's short-circuit feature to prevent unauthorized cross-origin requests from reaching…

Most recent entries from all

GHSA-6cqp-g7gg-8hr5 — Netty: Security Control Bypass via CORS Short-Circuit Failure