Product: REMS (AI-Powered Observability Platform) Vendor: OpsTree Solutions CWE: CWE-942 Permissive Cross-domain Policy with Untrusted Domains Author: Neel Saurabh Kotnis Status: Patched
REMS is affected by a permissive Cross-Origin Resource Sharing (CORS) configuration on its Governance API.
The affected API endpoints allow requests originating from arbitrary external domains. As a result, a malicious webpage can issue a cross-origin request to the API and, due to the permissive CORS policy, read the returned response in the browser.
The affected responses may contain sensitive governance and infrastructure information, including database host information, ports, database names, environment-related information, and operational metadata.
Successful exploitation can allow an attacker to:
Read sensitive Governance API responses from an attacker-controlled web origin
Disclose internal database and infrastructure information
Perform reconnaissance against internal infrastructure
Obtain operational information useful for targeted attacks
Component: Governance API / CORS Configuration
An attacker can host a webpage on an external origin containing JavaScript similar to:
When the page is opened in a browser, the browser performs the cross-origin request.
The vulnerable server responds with a permissive CORS policy that allows the external origin to access the response. The response can therefore be read by attacker-controlled JavaScript.
A representative response is:
Evidence note: Internal hostnames, addresses, usernames, passwords, database names, environment identifiers, and other deployment-specific information have been intentionally redacted from this public advisory.
Evidence note: Internal hostnames, addresses, usernames, passwords, database names, environment identifiers, and other deployment-specific information have been intentionally redacted from this public advisory.
The security-relevant behavior is the ability of an attacker-controlled web origin to read the API response cross-origin.
Fixed by OpsTree Solutions. The vendor has confirmed full remediation.
Recommended controls include:
Restrict Access-Control-Allow-Origin to explicitly trusted origins.
Do not allow arbitrary external origins.
Require appropriate authentication and authorization for sensitive Governance API resources.
Minimize sensitive information returned by API responses.
Disable CORS on internal or administrative APIs unless cross-origin access is required.
Review CORS configuration whenever new origins or frontend applications are introduced.
All versions prior to the patched release.
Vendor Acknowledgement
OpsTree Solutions has acknowledged this vulnerability and confirmed remediation.
Neel Saurabh Kotnis, Security Researcher.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
