Severe vulnerability is discovered in the popular event-driven platform StackStorm

According to the expert, the flaw could be exploited by a remote attacker to trick developers into executing arbitrary commands on targeted services. StackStorm has been used to automate workflows in many industries, it allows developers to configure actions, workflows, and scheduled tasks, to perform some operations on large-scale servers.

The ability of StackStorm of executing actions could be abused by a remote attacker with the knowledge of the flaw.

The vulnerability tied the way the StackStorm REST API improperly handled CORS (cross-origin resource sharing) headers, eventually enabling web browsers to perform cross-domain requests on behalf of
authenticated users/developers.

The expert noticed that the StackStorm API returned for Access-Control-Allow-Origin a null value if the origin of the request was unknown and the version is prior of 2.10.3/2.9.3 release.

The Access-Control-Allow-Origin header allows to determine which domains can access the resources of a site, leaving it misconfigured could allows attackers to gain access to the same resources.

In order to exploit the flaw, an attacker just needs to trick victims into clicking on a maliciously-crafted link, it this way it will be able to read/update/create actions and workflows, get internal IPs and execute a command on each machine which is accessible by StackStorm agent.

Tawily reported his findings to StackStorm team last week that quickly addressed it with the release of StackStorm versions 2.9.3 and 2.10.3.

Source: securityaffairs.co