oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients.
Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 5
https://github.com/middleapi/orpc/commit/daabded122a89d323357c4c401e879701864cb…
security-advisories@github.com
https://github.com/middleapi/orpc/issues/1661
security-advisories@github.com
https://github.com/middleapi/orpc/pull/1662
security-advisories@github.com
https://github.com/middleapi/orpc/releases/tag/v1.14.8
security-advisories@github.com
https://github.com/middleapi/orpc/security/advisories/GHSA-j9v4-rhgr-4m5f
security-advisories@github.com