Push endpoint returns permissive CORS headers

The push endpoint of a Vaadin application using server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, so a malicious site can make a cross origin request to it on behalf of a signed in user and read the response. This vulnerability has been addressed in the latest supported versions of Vaadin. Users are advised to upgrade.

Vaadin applications that enable server push handle push traffic with Atmosphere. Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false, which leaves Atmosphere's CorsInterceptor reflecting whatever Origin the request carries into Access-Control-Allow-Origin, next to Access-Control-Allow-Credentials: true. A browser therefore lets a page on any origin read the response of a push request made with the user's cookies.

Reading anything useful also requires the push identifier of that session, so the attack needs a second piece of information that is not itself exposed by this endpoint. That is why the issue scores Low rather than higher.

Applications that do not use @Push are not affected, because the endpoint is not registered. The WebSocket transport is not affected either, since the browser does not apply this header to it. The long polling and streaming transports are.

The behaviour reaches every version of the affected artifacts rather than a recent regression. It was introduced in Flow in January 2015, in a commit whose message describes the opposite of what the code does, and the same code is in Vaadin Framework 7 and 8 from the release that first shipped push.

The fixed versions pass true for that parameter, so Atmosphere stops emitting the header and the browser refuses the cross origin read. An application that deliberately relied on the reflected header for a cross origin setup can restore the old behaviour by setting the servlet init parameter described under Workaround to false.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version	Mitigation
Vaadin 14.14.0 - 14.14.7	Upgrade to 14.14.8
Vaadin 23.6.0 - 23.6.16	Upgrade to 23.6.17
Vaadin 24.4.0 - 24.4.25	Upgrade to 24.4.26
Vaadin 24.5.0 - 24.5.15	Upgrade to 24.7.17
Vaadin 24.6.0 - 24.6.13	Upgrade to 24.7.17
Vaadin 24.7.0 - 24.7.16	Upgrade to 24.7.17
Vaadin 24.8.0 - 24.8.17	Upgrade to 24.9.24
Vaadin 24.9.0 - 24.9.23	Upgrade to 24.9.24
Vaadin 24.10.0 - 24.10.11	Upgrade to 24.10.12
Vaadin 25.0.0 - 25.0.13	Upgrade to 25.2.11
Vaadin 25.1.0 - 25.1.13	Upgrade to 25.2.11
Vaadin 25.2.0 - 25.2.10	Upgrade to 25.2.11
Vaadin 25.3.0 - 25.3.2	Upgrade to 25.3.3
Vaadin Framework 7.1.0 - 7.7.54	Upgrade to 7.7.55
Vaadin Framework 8.0.0 - 8.32.1	Upgrade to 8.32.2

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version. The 24.5, 24.6, 24.8, 25.0 and 25.1 lines are out of maintenance and received no fix, so each row ends at the last version published on that line.

Workaround for applications that cannot upgrade yet: set the servlet init parameter org.atmosphere.cpr.dropAccessControlAllowOriginHeader to true on the Vaadin servlet. In a Spring Boot application the Vaadin servlet has to be registered explicitly for the parameter to be applied.

Maven coordinates	Vulnerable version	Fixed version
com.vaadin:vaadin	14.14.0 - 14.14.7	≥14.14.8
com.vaadin:vaadin	23.6.0 - 23.6.16	≥23.6.17
com.vaadin:vaadin	24.4.0 - 24.4.25	≥24.4.26
com.vaadin:vaadin	24.5.0 - 24.5.15	≥24.7.17
com.vaadin:vaadin	24.6.0 - 24.6.13	≥24.7.17
com.vaadin:vaadin	24.7.0 - 24.7.16	≥24.7.17
com.vaadin:vaadin	24.8.0 - 24.8.17	≥24.9.24
com.vaadin:vaadin	24.9.0 - 24.9.23	≥24.9.24
com.vaadin:vaadin	24.10.0 - 24.10.11	≥24.10.12
com.vaadin:vaadin	25.0.0 - 25.0.13	≥25.2.11
com.vaadin:vaadin	25.1.0 - 25.1.13	≥25.2.11
com.vaadin:vaadin	25.2.0 - 25.2.10	≥25.2.11
com.vaadin:vaadin	25.3.0 - 25.3.2	≥25.3.3
com.vaadin:vaadin-core	14.14.0 - 14.14.7	≥14.14.8
com.vaadin:vaadin-core	23.6.0 - 23.6.16	≥23.6.17
com.vaadin:vaadin-core	24.4.0 - 24.4.25	≥24.4.26
com.vaadin:vaadin-core	24.5.0 - 24.5.15	≥24.7.17
com.vaadin:vaadin-core	24.6.0 - 24.6.13	≥24.7.17
com.vaadin:vaadin-core	24.7.0 - 24.7.16	≥24.7.17
com.vaadin:vaadin-core	24.8.0 - 24.8.17	≥24.9.24
com.vaadin:vaadin-core	24.9.0 - 24.9.23	≥24.9.24
com.vaadin:vaadin-core	24.10.0 - 24.10.11	≥24.10.12
com.vaadin:vaadin-core	25.0.0 - 25.0.13	≥25.2.11
com.vaadin:vaadin-core	25.1.0 - 25.1.13	≥25.2.11
com.vaadin:vaadin-core	25.2.0 - 25.2.10	≥25.2.11
com.vaadin:vaadin-core	25.3.0 - 25.3.2	≥25.3.3
com.vaadin:flow-server	2.13.0 - 2.13.7	≥2.13.8
com.vaadin:flow-server	23.6.0 - 23.6.15	≥23.6.16
com.vaadin:flow-server	24.4.0 - 24.4.18	≥24.4.19
com.vaadin:flow-server	24.5.0 - 24.5.17	≥24.7.17
com.vaadin:flow-server	24.6.0 - 24.6.14	≥24.7.17
com.vaadin:flow-server	24.7.0 - 24.7.15	≥24.7.16
com.vaadin:flow-server	24.8.0 - 24.8.16	≥24.9.24
com.vaadin:flow-server	24.9.0 - 24.9.28	≥24.9.29
com.vaadin:flow-server	24.10.0 - 24.10.14	≥24.10.15
com.vaadin:flow-server	25.0.0 - 25.0.15	≥25.2.11
com.vaadin:flow-server	25.1.0 - 25.1.18	≥25.1.19
com.vaadin:flow-server	25.2.0 - 25.2.12	≥25.2.13
com.vaadin:flow-server	25.3.0 - 25.3.3	≥25.3.4
com.vaadin:vaadin-server	7.1.0 - 7.7.54	≥7.7.55
com.vaadin:vaadin-server	8.0.0 - 8.32.1	≥8.32.2
com.vaadin:vaadin-server-mpr-jakarta	7.7.36 - 7.7.54	≥7.7.55
com.vaadin:vaadin-server-mpr-jakarta	8.18.0 - 8.32.1	≥8.32.2

com.vaadin:flow-server is versioned independently of the Vaadin platform, so its numbers do not match the product versions above: the 14 line ships flow-server 2.13.x. com.vaadin:vaadin-server-mpr-jakarta carries the same class as com.vaadin:vaadin-server and is published as its own artifact. com.vaadin:vaadin-bom and com.vaadin:vaadin-push are not listed: the first carries no code, and the second brings Atmosphere but is not where the configuration is set.