CVE-2024-8024: Youdao Qanything CORS Misconfiguration Flaw

CVE-2024-8024 Overview

CVE-2024-8024 is a Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability in netease-youdao/qanything version 1.4.1. The application implements an overly permissive CORS policy that allows attackers to bypass the browser's Same-Origin Policy. A remote attacker can host a malicious page that issues cross-origin requests against a victim's authenticated qanything instance and read the responses. The flaw is categorized under [CWE-346: Origin Validation Error] and can lead to disclosure of sensitive information handled by the qanything knowledge-base and question-answering service.

Critical Impact
Remote, unauthenticated attackers can bypass the Same-Origin Policy to exfiltrate confidential data from authenticated qanything sessions without user interaction beyond visiting an attacker-controlled page.

Affected Products

netease-youdao qanything 1.4.1
Deployments exposing the qanything HTTP API to browsers with authenticated user sessions
Any downstream integration relying on qanything 1.4.1 CORS defaults

Discovery Timeline

2025-03-20 - CVE-2024-8024 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8024

Vulnerability Analysis

The vulnerability stems from an overly permissive CORS policy in qanything 1.4.1. CORS is an HTTP header-based mechanism that allows a server to declare which origins may access its resources through a browser. When configured incorrectly, CORS grants untrusted origins the ability to read authenticated cross-origin responses.

In qanything 1.4.1, the server reflects or accepts arbitrary Origin values and returns Access-Control-Allow-Credentials: true alongside them. This combination instructs the browser to include the victim's credentials on cross-origin requests and to deliver the responses to the attacker's JavaScript. The result is a bypass of the Same-Origin Policy for any user with an active qanything session.

Root Cause

The root cause is improper origin validation, tracked as [CWE-346]. The application does not enforce an allowlist of trusted origins before echoing the request Origin header into the Access-Control-Allow-Origin response header. Because qanything is a retrieval-augmented question-answering platform, the exposed endpoints may return document content, embeddings, chat history, and API responses that were intended to remain within the authenticated origin.

Attack Vector

The attack requires no privileges and no user interaction beyond loading an attacker-controlled web page while authenticated to qanything. The attacker's page issues authenticated XMLHttpRequest or fetch calls with credentials: 'include' to the qanything API. Because the server returns the attacker's origin in Access-Control-Allow-Origin and permits credentials, the browser hands the response body back to the malicious script. The script then exfiltrates the data to an attacker-controlled endpoint. The impact is limited to confidentiality; integrity and availability are not affected.

See the Huntr Bug Bounty Report for the technical write-up.

Detection Methods for CVE-2024-8024

Indicators of Compromise

Outbound HTTP requests from browser sessions to qanything endpoints originating from unexpected Referer or Origin values
Access-Control-Allow-Origin response headers that mirror arbitrary request Origin values combined with Access-Control-Allow-Credentials: true
Unusual spikes in authenticated API traffic to qanything document, chat, or knowledge-base endpoints from a single user session

Detection Strategies

Inspect qanything HTTP responses in a proxy or WAF for reflected Origin values in Access-Control-Allow-Origin headers
Perform an active configuration test by issuing preflight OPTIONS requests from arbitrary origins and confirming which values the server accepts
Correlate web server logs to identify authenticated sessions receiving requests carrying cross-origin Referer headers pointing to untrusted domains

Monitoring Recommendations

Log and alert on any CORS response where Access-Control-Allow-Origin is dynamic and Access-Control-Allow-Credentials is true
Monitor egress traffic from user workstations for exfiltration patterns following visits to unclassified external domains
Track qanything API endpoints that expose document content and chat history for abnormal request volume per session

How to Mitigate CVE-2024-8024

Immediate Actions Required

Restrict qanything 1.4.1 network exposure to trusted internal networks or place it behind an authenticating reverse proxy that enforces a strict CORS policy
Configure an allowlist of trusted origins at the reverse proxy or application gateway and reject requests with untrusted Origin headers
Require SameSite=Strict or SameSite=Lax cookies for qanything session tokens to reduce cross-origin credential leakage

Patch Information

No vendor advisory or fixed version is listed in the NVD entry for CVE-2024-8024. Track the Huntr Bug Bounty Report and the upstream netease-youdao/qanything repository for a patched release beyond 1.4.1.

Workarounds

Deploy an upstream reverse proxy such as nginx or envoy that overwrites CORS headers with a static allowlist before responses reach the browser
Disable Access-Control-Allow-Credentials on any endpoint that does not require authenticated cross-origin access
Educate users to log out of qanything before browsing untrusted sites, and enforce short session lifetimes on the application

bash

# Example nginx configuration enforcing a strict CORS allowlist
map $http_origin $cors_ok {
    default "";
    "https://qanything.internal.example.com" $http_origin;
}

server {
    location /api/ {
        if ($cors_ok = "") { return 403; }
        add_header Access-Control-Allow-Origin  $cors_ok always;
        add_header Access-Control-Allow-Credentials "true" always;
        add_header Vary Origin always;
        proxy_pass http://qanything_backend;
    }
}