^{CVE-2020-26251:}Open Zaak before version 1.3.3 had an insecure Cross-Origin Resource Sharing (CORS) policy that allowed any client, potentially enabling cross-site request forgery attacks.

Overview

CVE-2020-26251 affects Open Zaak versions before 1.3.3. The vulnerability (CWE-346: Origin Validation Error) stems from an overly permissive CORS policy that allowed any origin to make requests to Open Zaak installations. This could potentially enable attackers to craft malicious websites that make cross-origin requests to known Open Zaak instances using the victim's browser. The vulnerability was particularly concerning because it affected production environments when it was only intended for development use on localhost. However, several security controls were in place that limited the actual exploitability of this vulnerability, including Same-Site cookie restrictions, authentication requirements for sensitive data access, disabled credentials in cross-origin requests, and CSRF protections.

Remediation

To remediate this vulnerability:

1. Upgrade Open Zaak to version 1.3.3 or later, which disables CORS by default
2. If CORS is required for specific use cases, explicitly configure it through environment variables with appropriate restrictions
3. Ensure that only trusted origins are allowed in your CORS configuration
4. Maintain other security controls such as Same-Site cookie policies and CSRF protections
5. Review server logs for any suspicious cross-origin requests that may indicate attempted exploitation

For organizations unable to upgrade immediately, implementing strict CORS policies through web server configuration (like Apache or Nginx) can provide temporary mitigation.

References

1. Open Zaak Changelog for version 1.3.3: https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17
2. Fix commit: https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46
3. GitHub Security Advisory: https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7
4. CWE-346: Origin Validation Error: https://cwe.mitre.org/data/definitions/346.html
5. OWASP CORS guidance: https://owasp.org/www-community/attacks/CORS_OriginHeaderScrutiny