-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.micronaut:micronaut-http-server | maven | < 3.8.3 | 3.8.3 |
| io.micronaut:micronaut-http-server-netty | maven | < 3.8.3 | 3.8.3 |
| io.micronaut:micronaut-http-server-tck | maven | < 3.8.3 | 3.8.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from insufficient validation of localhost/loopback addresses in CORS checks. The pre-patch code in CorsFilter.java used naive string matching that failed to: 1) Recognize 127.x.x.x IP addresses as local, 2) Properly validate() origin hostnames via URI parsing. The commit introduced isHostLocal() and isOriginLocal() to address these gaps by checking for multiple local patterns and using proper URI validation. The vulnerable functions directly implemented the flawed validation logic that allowed simple requests from external origins to target localhost endpoints.