9.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2020-36851

CVE-2020-36851: Rob--W cors-anywhere Misconfigured CORS Proxy Allows SSRF

Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets (SSRF). Because the proxy forwards requests and headers, an attacker can reach internal-only endpoints and link-local metadata services, retrieve instance role credentials or other sensitive metadata, and interact with internal APIs and services that are not intended to be internet-facing. The vulnerability is exploitable by sending crafted requests to the proxy with the target resource encoded in the URL; many cors-anywhere deployments forward arbitrary methods and headers (including PUT), which can permit exploitation of IMDSv2 workflows as well as access to internal management APIs. Successful exploitation can result in theft of cloud credentials, unauthorized access to internal services, remote code execution or privilege escalation (depending on reachable backends), data exfiltration, and full compromise of cloud resources. Mitigation includes: restricting the proxy to trusted origins or authentication, whitelisting allowed target hosts, preventing access to link-local and internal IP ranges, removing support for unsafe HTTP methods/headers, enabling cloud provider mitigations, and deploying network-level protections.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2020-36851

CVE-2020-36851:

9.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cors-anywhere	npm	<= 0.4.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2020-36851, is a Server-Side Request Forgery (SSRF) in cors-anywhere. The root cause is not a specific bug, but the inherent design of the package when deployed as an open proxy without proper security configurations. The package is designed to proxy requests to any URL, and in its default configuration, it lacks restrictions on the target of these requests.

My analysis focused on identifying the core functions responsible for this proxying behavior, as these are the functions that would be exploited. By examining the code and the discussions in the associated GitHub issues (particularly issue #78, which discusses mitigating this SSRF), I pinpointed the request handling flow.

The process begins in the anonymous function returned by getHandler in lib/cors-anywhere.js. This function acts as the main request handler. It extracts the target URL from the path of the incoming request. This is the entry point for the user-controlled, malicious input.
This handler then calls the proxyRequest function, passing along the parsed URL.
The proxyRequest function takes this URL and uses it to configure the http-proxy, setting the URL as the target of the outbound request. It then initiates the request using proxy.web().

At no point in this default flow is the target URL validated to ensure it does not point to internal services, cloud metadata endpoints, or other sensitive resources. This allows an attacker to craft a request to the cors-anywhere instance that causes the server to make a request to an arbitrary internal system.

The identified functions, getHandler.anonymous and proxyRequest, are therefore the key runtime indicators of this vulnerability. When this SSRF is exploited, these functions would appear in a stack trace or profiler output as they are directly involved in processing the malicious request and making the outbound connection.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.