Python: CORS Bypass

[porcupineyhairs]

Query PR

github/codeql#16814

Language

Python

CVE(s) ID list

GHSA-824x-jcxf-hpfg
CVE-2022-3457

CWE

CWE-346

Report

This PR adds a query to detect a Cross Origin Resource Sharing(CORS) policy bypass due to an incorrect check.

This PR attempts to detect the vulnerability pattern found in CVE-2022-3457

if request.method in ['POST', 'PUT', 'PATCH', 'DELETE']:
    origin = request.headers.get('Origin', None)
    if origin and not origin.startswith(request.base):
        raise cherrypy.HTTPError(403, 'Unexpected Origin header')

In this case, a value obtained from a header is compared using startswith call. This comparision is easily bypassed resulting in a CORS bypass. Given that similar bugs have been found in other languages as well, I think this PR would be a great addition to the exisitng python query pack.

The databases for CVE-2022-3457 can be downloaded from

https://filetransfer.io/data-package/i4Mfepls#link
https://file.io/V67T4SSgmExF

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

• Yes
• No

Blog post link

No response

[ghsecuritylab]

Your submission is now in status Results analysis.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Query review.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Final decision.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[xcorail]

Created Hackerone report 2590110 for bounty 594470 : [833] Python: CORS Bypass

[ghsecuritylab]

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[porcupineyhairs]

@xcorail Thanks for the quick bounty.

[porcupineyhairs]

@xcorail This bounty application was closed before the PR was reviewed. I have added a qhelp and the tests now. With this, I would request that the H1 bounty severity be bumped to medium.

[xcorail]

Hello @porcupineyhairs
I will have a look

[xcorail]

Hello @porcupineyhairs

I re-scored the submission with the addition of the doc and tests, and it changed the overall score, but not significantly enough to pass the next level bar. Keep in mind that the documentation quality criteria is only one of the various factors that we score for a submission.

Best