RESTEasy CORS Preflight Credential Leakage Fix Analysis (RESTEASY-3706)

Vulnerability Overview This commit ( ) merged Pull Request #5008 from , primarily addressing a security issue regarding CORS preflight requests and : if a request includes an header and is configured, but no specific allowed Origins are explicitly defined, the system defaults to allowing all Origins ( ) and returns . This configuration may pose a risk of cross-origin credential leakage. Scope of Impact Affected Component: (RESTEasy's CORS filter). Trigger Conditions: - The request is a CORS preflight request ( method + header); - is set to ; - No explicit list of allowed Origins is configured (i.e., the wildcard is used). Risk: When and are present simultaneously, some browsers may reject the request or exhibit inconsistent behavior. In older versions, this misconfiguration could lead to credentials (such as Cookies) being incorrectly allowed in cross-origin scenarios. Remediation 1. Default Behavior Change: Changed the default value of from to (refer to the update of in ). 2. Wildcard Origin Handling: When is used as the allowed Origin and is , the filter logs a warning ( ) and correctly sets the and headers in the response. 3. Test Coverage: Added/updated to cover the following scenarios: - When the default is , the response headers should not contain ; - When is explicitly set to and is allowed, the response headers should include ; - For preflight requests to specific Origins (e.g., ), verify the correctness of and . POC / Exploitation Code The source page does not contain an independent POC or exploitation code block; however, the test class provides test cases that can reproduce the issue (excerpt): This test is used to verify that, after the fix, when is and is allowed, the response headers correctly include , thereby confirming that the vulnerability has been remediated.

Goal Reached Thanks to every supporter — we hit 100%!

RESTEasy CORS Preflight Credential Leakage Fix Analysis (RESTEASY-3706)

More from this source