8000 Fix CORS vulnerability by replacing wildcard '*' with configurable and restricted origins. by zeropath-ai[bot] · Pull Request #994 · TracecatHQ/tracecat · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Fix CORS vulnerability by replacing wildcard '*' with configurable and restricted origins. #994

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

Fix CORS vulnerability by replacing wildcard '*' with configurable and restricted origins. #994

wants to merge 1 commit into from

Conversation

zeropath-ai[bot]
Copy link
@zeropath-ai zeropath-ai bot commented Apr 4, 2025

Summary

Pull Request Summary:

  • The Vulnerability Description:
    Previously, the CORS policy allowed requests from any origin using a wildcard ('*'). This made the application vulnerable to cross-origin attacks as it failed to restrict access to trusted domains.

  • This Fix:
    Modified the CORS settings to limit allowed origins based on configuration values (TRACECAT__ALLOW_ORIGINS) or the default public app URL (TRACECAT__PUBLIC_APP_URL). This ensures that only trusted origins can interact with the application.

  • The Cause of the Issue:
    The usage of the wildcard ('*') in the CORS policy meant unrestricted access was granted to all origins. This created a security risk by allowing untrusted domains to potentially exploit the API's functionality.

  • The Patch Implementation:
    Introduced a conditional logic to derive allow_origins—if explicitly configured, it processes a list of origins from TRACECAT__ALLOW_ORIGINS. Otherwise, it defaults to the public app URL (TRACECAT__PUBLIC_APP_URL). This removes the use of the wildcard and enforces origin validation.

Vulnerability Details

  • Vulnerability Class: Insecure CORS
  • Severity: 6.3
  • Affected File: tracecat/api/app.py
  • Vulnerable Lines: 262-262

Code Snippets

diff --git a/tracecat/api/app.py b/tracecat/api/app.py
index c06168ce..9e848496 100644
--- a/tracecat/api/app.py
+++ b/tracecat/api/app.py
@@ -127,10 +127,12 @@ def fastapi_users_auth_exception_handler(request: Request, exc: FastAPIUsersExce
 
 
 def create_app(**kwargs) -> FastAPI:
-    if config.TRACECAT__ALLOW_ORIGINS is not None:
-        allow_origins = config.TRACECAT__ALLOW_ORIGINS.split(",")
-    else:
-        allow_origins = ["*"]
+    # Set default CORS origins to public app URL if no origins explicitly configured
+    allow_origins = []
+    if config.TRACECAT__ALLOW_ORIGINS:
+        allow_origins = [origin.strip() for origin in config.TRACECAT__ALLOW_ORIGINS.split(",")]
+    if not allow_origins and config.TRACECAT__PUBLIC_APP_URL:
+        allow_origins = [config.TRACECAT__PUBLIC_APP_URL]
     app = FastAPI(
         title="Tracecat API",
         description=(

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai!

To request modifications, please post a comment beginning with @zeropath-ai and specify the changes required.

@zeropath-ai will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_insecure_cors_1743786393308179

# if vscode is installed run (or use your favorite editor / IDE):
code tracecat/api/app.py

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_insecure_cors_1743786393308179

@zeropath-ai zeropath-ai bot mentioned this pull request Apr 4, 2025
Open
1 task
@topher-lo
Copy link
Contributor

False positive. TRACECAT__ALLOW_ORIGINS is set across prod

@topher-lo topher-lo closed this Apr 4, 2025
@topher-lo topher-lo deleted the zvuln_fix_insecure_cors_1743786393308179 branch April 12, 2025 19:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@topher-lo
0