Insecure default value for CORS configuration
GHSA-g27j-74fp-xfpr · CVE-2022-26969
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
The default value for the CORS_ENABLED and CORS_ORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.
Patches
The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0
Workarounds
Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.
For more information
If you have any questions or comments about this advisory:
- Open an issue in directus/directus
- Email us at security@directus.io
References
- WEB https://github.com/directus/directus/security/advisories/GHSA-g27j-74fp-xfpr
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-26969
- WEB https://github.com/directus/directus/pull/12022
- WEB https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
- PACKAGE https://github.com/directus/directus
- WEB https://github.com/directus/directus/blob/8daed9c41baeaf1d08c1e292bf9f0dcef65e48fb/docs/configuration/config-options.md
- WEB https://github.com/directus/directus/releases/tag/v9.7.0
- WEB https://security.snyk.io/vuln/SNYK-JS-DIRECTUS-2441822
Ready to move
Start Securing
Free, no credit card | First findings in minutes