Executive brief
A vulnerability in the elysia-cors library, which manages security permissions for web applications, allows attackers to bypass domain restrictions. By using a domain name that contains a trusted domain as a substring (e.g., 'trusted.com.attacker.com'), an attacker can trick the system into granting unauthorized access. This could lead to unauthorized interactions with user data on websites using this library.
Technical details
The elysia-cors library (versions up to 1.3.0) incorrectly validates the 'Origin' header by performing a substring match instead of an exact match against the configured whitelist. An attacker can bypass CORS policies by hosting a malicious site on a domain that contains the legitimate domain as a substring (e.g., 'victim.com.malicious.com' bypassing a 'victim.com' policy). This vulnerability is classified as CWE-178 (Improper Handling of Case Sensitivity/Origin Validation Error). A fix was introduced in version 1.3.1 which implements strict origin checking.
Affected products
- elysiajs elysia-cors thru 1.3.0
Timeline
- 2025-05-08: patched: Fixed in version 1.3.1 via commit 9b9eb92e32a7a4b43b6d5108668941701c33e221
- 2025-08-20: disclosed
- 2025-08-20: advisory