Description
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
heyform heyform
Default version status: unaffected
0 to < 3.0.0-rc.8affected
References
- https://github.com/heyform/heyform/security/advisories/GHSA-fg7j-rmgr-rc9g ↗
- https://github.com/heyform/heyform/blob/v3.0.0-rc.7/packages/server/src/main.ts ↗
- https://github.com/heyform/heyform/commit/bf9d738ca70ae5641c0c7372982b00365c5144d4 ↗
- https://github.com/heyform/heyform ↗
- https://www.vulncheck.com/advisories/heyform-reflects-any-origin-in-cors-responses-while-allowing-credentials ↗