Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.4epss 0.4%
probabilidade de exploração
0.4%top 66% das CVEs
exploração observada
nãonenhuma fonte reporta
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Produtos afetados
litestar-org · litestarReferências
https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0https://github.com/litestar-org/litestar/commit/eb87703b309efcc0d1b087dcb12784e76b003d5ahttps://github.com/litestar-org/litestar/releases/tag/v2.20.0https://github.com/litestar-org/litestar/security/advisories/GHSA-2p2x-hpg8-cqp2