Overly Permissive CORS Whitelist

[GiulioMartino]

Access-Control-Allow-Origin:"*"

I can change this value or disable it ?

Thank you very much

[evilaliv3]

Thank you for your question @GiulioMartino

There is actually no concern on this matter since globaleaks but i agree that limiting the allow-control-allow-origin header to the same origin would be an enhancement nonetheless.

I've opened a dedicated ticket where you will be able to follow the improvement: https://github.com/globaleaks/globaleaks-whistleblowing-software/issues/4503

For curiosity may i ask you what lead you to look into these details? Please let us know if you have perfomed or requested a security audit and you would like to republish the report publicly for the benefit of the project.

thank you!

[evilaliv3]

@GiulioMartino : actually running a WAF in front of globaleaks breaks the threat model and risks to log sensible information on the WAF.

Please feel free to reach out to me on community.globaleaks.org.

As well i invity you to check https://securityheaders.com/?q=https%3A%2F%2Fdemo.globaleaks.org%2F
GlobaLeaks by default does not implement a wildcard on this header.

[GiulioMartino]

@evilaliv3 I have an outdated version (version 4.11.5) probably depends on this. I'll do an upgrade. If i disable the WAF :

[evilaliv3]

got it.

Closing the ticket then.

[evilaliv3]

By the way @GiulioMartino you are very welcome, please feel provide every suggestion you might have.

[GiulioMartino]

Hi Giovanni I updated the version and now everything is ok. Thanks for the precious support!

[evilaliv3]

@GiulioMartino : actually looking into the code i see the header is already set to same-origin:

https://securityheaders.com/?q=https%3A%2F%2Fdemo.globaleaks.org%2F

Which is the site that you have audited?