Description (CNA)
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via 'use server' can be invoked with the victim's cookies attached. This issue has been patched in version 1.0.0-beta.1.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| wakujs / waku | affected < 1.0.0-beta.1 |
CWE
CWE-352
References
- https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q
- https://github.com/wakujs/waku/releases/tag/v1.0.0-beta.1
ADP enrichment
No English description supplied.
No references supplied.