{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Home/issues/3106","repository_url":"https://api.github.com/repos/aspnet/Home","labels_url":"https://api.github.com/repos/aspnet/Home/issues/3106/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Home/issues/3106/comments","events_url":"https://api.github.com/repos/aspnet/Home/issues/3106/events","html_url":"https://github.com/aspnet/Home/issues/3106","id":318717815,"number":3106,"title":"CORS security: reflecting any origin header value when configured to *  is dangerous","user":{"login":"chenjj","id":2682905,"avatar_url":"https://avatars3.githubusercontent.com/u/2682905?v=4","gravatar_id":"","url":"https://api.github.com/users/chenjj","html_url":"https://github.com/chenjj","followers_url":"https://api.github.com/users/chenjj/followers","following_url":"https://api.github.com/users/chenjj/following{/other_user}","gists_url":"https://api.github.com/users/chenjj/gists{/gist_id}","starred_url":"https://api.github.com/users/chenjj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chenjj/subscriptions","organizations_url":"https://api.github.com/users/chenjj/orgs","repos_url":"https://api.github.com/users/chenjj/repos","events_url":"https://api.github.com/users/chenjj/events{/privacy}","received_events_url":"https://api.github.com/users/chenjj/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-04-29T13:38:51Z","updated_at":"2018-05-11T13:11:59Z","closed_at":null,"author_association":"NONE","body":"When CORS policy is configured to `WithOrigins(\"*\")`, asp.net CORS will actively convert it to reflect any Origin header value. This kind of behavior is dangerous and has caused many security problems in the past.\r\n\r\nSome similar security issues:\r\n[cyu/rack-cors#126](https://github.com/cyu/rack-cors/issues/126)\r\n[https://nodesecurity.io/advisories/148](https://nodesecurity.io/advisories/148)\r\n\r\nSome related blog posts:\r\n[https://ejj.io/misconfigured-cors/](https://ejj.io/misconfigured-cors/)\r\n[http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html](http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html)\r\n"},"comment":{"url":"https://api.github.com/repos/aspnet/Home/issues/comments/388359207","html_url":"https://github.com/aspnet/Home/issues/3106#issuecomment-388359207","issue_url":"https://api.github.com/repos/aspnet/Home/issues/3106","id":388359207,"user":{"login":"blowdart","id":796298,"avatar_url":"https://avatars2.githubusercontent.com/u/796298?v=4","gravatar_id":"","url":"https://api.github.com/users/blowdart","html_url":"https://github.com/blowdart","followers_url":"https://api.github.com/users/blowdart/followers","following_url":"https://api.github.com/users/blowdart/following{/other_user}","gists_url":"https://api.github.com/users/blowdart/gists{/gist_id}","starred_url":"https://api.github.com/users/blowdart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowdart/subscriptions","organizations_url":"https://api.github.com/users/blowdart/orgs","repos_url":"https://api.github.com/users/blowdart/repos","events_url":"https://api.github.com/users/blowdart/events{/privacy}","received_events_url":"https://api.github.com/users/blowdart/received_events","type":"User","site_admin":false},"created_at":"2018-05-11T13:11:59Z","updated_at":"2018-05-11T13:11:59Z","author_association":"MEMBER","body":"We've been looking at this. So yes, in theory it can do ugly things, *if* you end up reflecting the origin header, and you don't encode it, and it's reflected in the body. Which is pretty hard to do unless you end up using Html.Raw. Having said that we're looking at actually validating the incoming header to at least ensure it's a valid host, in terms of character validation, and ensuring you can't do * and allow credentials. We do default to not allowing credentials, so we don't exhibit one of the problems you linked to, because it's only dangerous with allow credentials and *.\r\n\r\nWe do have folks going through the portswigger blog to see if we can make the API safer and help to avoid some of that misconfiguration."}}
{"actor":{"display_login":"blowdart"}}