Network-AI Origin Validation Flaw Exposes Localhost Endpoints

Executive Summary

Network-AI before 5.15.2 has an origin validation error in McpSseServer._handleRequest that incorrectly reflects localhost Origins into Access-Control-Allow-Origin even when the server binds a non-loopback address. This allows an attacker's page with a localhost Origin to read unauthenticated endpoints like /health from a victim's browser via cross-origin requests.

Useful 0 Not Useful 0

Detection Guidance

Check if Network-AI (npm network-ai) version is below 5.15.2 by running: npm list network-ai. Inspect server logs for requests with localhost Origin headers to non-loopback addresses. Use curl to test endpoints like /health with Origin: localhost header.

Useful 0 Not Useful 0

Impact Analysis

If you use Network-AI in a non-loopback environment, an attacker could trick you into visiting a malicious page that exploits this flaw to access sensitive endpoints like /health without authentication. This could expose internal server information or other unauthenticated resources.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing unauthenticated endpoints like /health to cross-origin requests due to incorrect CORS origin validation. If exploited, it may allow unauthorized access to sensitive health or personal data, violating data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Network-AI to version 5.15.2 or later using npm update network-ai. If immediate upgrade is not possible, restrict server binding to loopback address (127.0.0.1) or implement proper origin validation middleware.

Useful 0 Not Useful 0