Listen to this Post
The vulnerability resides in the `match_host` function within src/bokeh/server/util.py. This function is responsible for validating incoming hostnames against a configured allowlist using pattern matching. The flawed logic uses `zip()` to iterate over corresponding parts of the hostname and the allowlist pattern. The `zip()` function stops at the shortest sequence, so it only compares segment pairs until the pattern ends. The function checks if the pattern is longer than the host but crucially omits a check for the opposite case. Consequently, a malicious hostname that simply starts with the pattern’s segments will match. For example, with an allowlist of ['example.com'], the host `example.com.bad.com` is incorrectly validated because `zip()` compares only ‘example’ and ‘com’ before stopping, finding a match, and returning True. This allows an attacker’s domain to bypass the origin check.
DailyCVE Form:
Platform: Bokeh
Version: < 3.8.2
Vulnerability: Origin Validation Bypass
Severity: Critical
date:
Prediction: Patched 2024
What Undercode Say:
Vulnerable code snippet from match_host function
pattern_parts = pattern.split('.')
host_parts = host.split('.')
if len(pattern_parts) > len(host_parts):
return False
Flawed comparison - missing check for len(host_parts) > len(pattern_parts)
for p, h in zip(pattern_parts, host_parts):
if p != '' and p != h:
return False
return True Incorrect match for example.com vs example.com.bad.com
Check Bokeh server version python -c "import bokeh; print(bokeh.<strong>version</strong>)"
How Exploit:
1. Attacker registers similar domain.
2. Creates malicious landing page.
3. Victim visits attacker page.
4. Page initiates WebSocket connection.
5. Flawed origin check passes.
6. Attacker hijacks session.
Protection from this CVE
- Update to >=3.8.2.
- Implement additional authentication.
- Use strict network policies.
Impact:
- Data exfiltration.
- Session hijacking.
- Unauthorized dashboard modification.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
