CVE-2020-36851
BaseFortify
Publication date: 2025-09-25
Last updated on: 2025-09-26
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rob-w | cors-anywhere | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
| CWE-942 | The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves cors-anywhere instances configured as open proxies that allow unauthenticated external users to make the server send HTTP requests to arbitrary targets (Server-Side Request Forgery - SSRF). Attackers can use this to access internal-only endpoints, metadata services, retrieve cloud instance credentials, and interact with internal APIs not meant to be internet-facing. Exploitation is done by sending crafted requests with the target resource encoded in the URL, potentially using unsafe HTTP methods and headers. This can lead to theft of cloud credentials, unauthorized access, remote code execution, privilege escalation, data exfiltration, and full compromise of cloud resources.
How can this vulnerability impact me? :
The impact includes theft of cloud credentials, unauthorized access to internal services, remote code execution or privilege escalation depending on the reachable backends, data exfiltration, and potentially full compromise of cloud resources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting the proxy to trusted origins or requiring authentication, whitelisting allowed target hosts, preventing access to link-local and internal IP ranges, removing support for unsafe HTTP methods and headers, enabling cloud provider mitigations, and deploying network-level protections.