CVE-2017-11173 Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request
A regex flaw in rack-cors allows malicious sites to bypass CORS restrictions, enabling unauthorized cross-origin requests if specific domain configurations are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-11173?
CVE-2017-11173 is a high-severity vulnerability in Debian Debian Linux, published on 13 Jul 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.
Which versions are affected by CVE-2017-11173?
2 open source packages ship an affected version, including rack-cors. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
rack-cors RubyGems | All versions | 0.4.1 |
rack-cors RubyGems | All versions | 0.4.1 |
Products include Debian Debian Linux, Rack-Cors Project Rack-Cors.
How do I fix CVE-2017-11173?
Upgrade rack-cors to 0.4.1 or later.
Is CVE-2017-11173 being exploited?
There is no known exploitation of CVE-2017-11173 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2017-11173, DSA-3931-1, GHSA-2j9c-9vmv-7m39, UBUNTU-CVE-2017-11173.