HeyForm Origin Header CORS Misconfiguration Leads to Authenticated Data Exposure

Executive Summary

This vulnerability is an insecure Cross-Origin Resource Sharing (CORS) configuration in HeyForm before version 3.0.0-rc.8. The server reflected the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers could exploit this to send authenticated GraphQL queries from malicious pages visited by logged-in users, accessing or modifying sensitive data like workspaces, forms, submissions, and account settings.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your HeyForm server uses the insecure CORS configuration by inspecting the server code for app.enableCors({ origin: true, credentials: true }); or similar settings. Review network traffic for reflected Origin headers in CORS responses with credentials enabled.

Useful 0 Not Useful 0

Impact Analysis

If you are a HeyForm user, an attacker could trick you into visiting a malicious page. The attacker could then access your sensitive data such as workspaces, forms, submissions, and account settings. They could also modify your account settings or delete forms and submissions without your knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personally identifiable information (PII) and other sensitive data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, unauthorized data processing, and failure to maintain data confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Update HeyForm to version 3.0.0-rc.8 or later. Replace origin reflection with an explicit allowlist for CORS origins using the CORS_ALLOWED_ORIGINS environment variable. Avoid using origin: true and credentials: true together in CORS configurations.

Useful 0 Not Useful 0