Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

CORS middleware reflects Origin with Allow-Credentials, enabling cross-origin attacks (CWE-346)

未关闭
  • 哪里不对？
#6,390 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@R-zin 已经在做这个了。

开始于 2026年10月4日。

  • #6408 来自 @R-zin —— 未关闭

评估

难度
3/5
预计耗时
1-2 天
新手友好度
68/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
冷清
技术栈
python
领域
api, backend, security

调研方向

先阅读所引用的 st2common/st2common/middleware/cors.py 第 65-69、88 和 91 行，并跟踪已配置的 origin 如何变为响应头。确认通配符 origin 不会获得 credentials，显式列入 allowlist 的 origin 会保留 credentials，并且硬编码的 localhost origin 不存在于生产默认值中。

由索引模型根据 Issue 内容生成。

描述

Summary

The CORS middleware reflects the request's Origin header back as Access-Control-Allow-Origin when the configured allow_origin contains *, while simultaneously setting Access-Control-Allow-Credentials: true. This is a well-known CORS misconfiguration that allows any website to make authenticated cross-origin requests to the StackStorm API.

Affected File

st2common/st2common/middleware/cors.py (lines 65-69, 88, 91)

if origin:
    if "*" in origins:
        origin_allowed = origin  # reflects whatever the browser sends
    else:
        origin_allowed = origin if origin in origins else list(origins)[0]
# ...
headers["Access-Control-Allow-Origin"] = origin_allowed
# ...
headers["Access-Control-Allow-Credentials"] = "true"  # always set

Additionally, the middleware hardcodes localhost development origins that are always allowed:

# Default gulp development server WebUI URL
origins.add("http://127.0.0.1:3000")

# By default WebUI simple http server listens on 8080
origins.add("http://localhost:8080")
origins.add("http://127.0.0.1:8080")

Impact

When allow_origin contains *:
Any website can make authenticated, credential-bearing requests to the StackStorm API from a user's browser. If a StackStorm user visits a malicious page while logged in, the attacker can:

  • Read API responses (execution results, datastore values, pack configurations)
  • Trigger action executions
  • Modify rules and workflows
  • Exfiltrate API keys and tokens

This is because the combination of a reflected Access-Control-Allow-Origin and Access-Control-Allow-Credentials: true tells the browser to include cookies/auth headers and allow the response to be read by the requesting page.

Hardcoded localhost origins:
If an attacker can run a web server on localhost:3000 or localhost:8080 on a machine where a StackStorm user has an active session, they can exploit these hardcoded origins. These should not be present in production builds.

Recommended Fix

  1. Never reflect the Origin header when Access-Control-Allow-Credentials is true. If wildcard origin is configured, either:

    • Set Access-Control-Allow-Origin: * and remove Access-Control-Allow-Credentials (allows unauthenticated CORS only)
    • Or reject the configuration and log a warning

  2. Remove hardcoded localhost origins from the default allowed list. These should only be present in development configurations.

  3. Only set Access-Control-Allow-Credentials: true when the origin is explicitly whitelisted (not wildcarded).

if origin and origin in origins:
    headers["Access-Control-Allow-Origin"] = origin
    headers["Access-Control-Allow-Credentials"] = "true"
elif "*" in origins:
    headers["Access-Control-Allow-Origin"] = "*"
    # Do NOT set Allow-Credentials with wildcard origin

References

主要语言
Python
星标
6.5k
派生
794
平均合并
1 天 11 小时
30 天内合并 PR
5

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

StackStorm/st2 的其他 Issue

查看 StackStorm/st2 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。