nccgroup / sobelow

Security-focused static analysis for the Phoenix Framework
Apache License 2.0
1.66k stars 92 forks source link

Support detecting for Wildcard check_origin Vulnerability #117

Open houllette opened 1 year ago

houllette commented 1 year ago

We should create a new detection for the vulnerability that was patched in the Phoenix 1.3.5, 1.4.18, 1.5.14, and 1.6.14 releases - this could be done somewhat similarly to how Vuln.Ecto works with some conditional logic for checking if wildcard origin is present.

https://elixirforum.com/t/phoenix-1-3-1-4-1-5-and-1-6-security-releases-for-wildcard-check-origin-vulnerability/50902