CVE-2024-8183: Prefect CORS Information Disclosure Issue

CVE-2024-8183 Overview

CVE-2024-8183 is a Cross-Origin Resource Sharing (CORS) misconfiguration in prefecthq/prefect version 2.20.2. The Prefect server accepts requests from any origin because its middleware hardcodes allow_origins=["*"], allow_methods=["*"], and allow_headers=["*"]. Unauthorized web origins can issue authenticated cross-origin requests to the Prefect API when a user visits an attacker-controlled page. Successful exploitation may result in unauthorized database access, data leakage, service disruption, and integrity loss. The weakness is classified as Origin Validation Error [CWE-346].

Critical Impact
Any malicious origin can invoke Prefect server endpoints on behalf of an authenticated user, exposing orchestration data and workflow state.

Affected Products

prefecthq/prefect version 2.20.2
Prefect Server deployments using default CORS middleware settings
Downstream applications relying on Prefect 2.x REST API

Discovery Timeline

2025-03-20 - CVE-2024-8183 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8183

Vulnerability Analysis

The Prefect server registers the Starlette CORSMiddleware with wildcard values for allowed origins, methods, and headers. This configuration disables the browser's Same-Origin Policy protections for the API surface. When a Prefect user with an active session visits a malicious site, that site's JavaScript can issue cross-origin requests to the Prefect server and read the responses. The attacker gains the ability to enumerate flows, deployments, and secrets accessible through the REST API. The flaw requires user interaction (UI:R) and executes over the network with no privileges required.

Root Cause

The root cause is an insecure default in src/prefect/server/api/server.py. The middleware is instantiated with allow_origins=["*"], allow_methods=["*"], and allow_headers=["*"], providing no mechanism for operators to restrict cross-origin callers. Origin validation is effectively absent, matching the pattern described by [CWE-346].

Attack Vector

An attacker hosts a page that triggers fetch() or XMLHttpRequest calls to a victim's Prefect server. When the victim visits the page while authenticated to Prefect, the browser attaches session context and the server returns sensitive JSON data to the attacker's origin. No credentials theft or network position is required beyond luring the victim to a controlled URL.

python

     # middleware
     app.add_middleware(
         CORSMiddleware,
-        allow_origins=["*"],
-        allow_methods=["*"],
-        allow_headers=["*"],
+        allow_origins=prefect.settings.PREFECT_SERVER_CORS_ALLOWED_ORIGINS.value().split(
+            ","
+        ),
+        allow_methods=prefect.settings.PREFECT_SERVER_CORS_ALLOWED_METHODS.value().split(
+            ","
+        ),
+        allow_headers=prefect.settings.PREFECT_SERVER_CORS_ALLOWED_HEADERS.value().split(
+            ","
+        ),
     )

Source: GitHub Commit a69266e — the patch replaces wildcard middleware arguments with configurable settings.

Detection Methods for CVE-2024-8183

Indicators of Compromise

Prefect server HTTP responses containing Access-Control-Allow-Origin: * on authenticated API routes.
Unexpected cross-origin OPTIONS preflight requests to Prefect API endpoints such as /api/flows/ or /api/deployments/.
Referer or Origin headers on API calls that do not match approved Prefect UI hostnames.

Detection Strategies

Inspect running Prefect 2.x deployments for the vulnerable middleware initialization in src/prefect/server/api/server.py.
Query configured environment variables to confirm PREFECT_SERVER_CORS_ALLOWED_ORIGINS is set to specific hostnames rather than *.
Review reverse-proxy or WAF logs for anomalous Origin header values reaching the Prefect API.

Monitoring Recommendations

Alert on Prefect API responses that echo Access-Control-Allow-Origin: * outside development environments.
Track cross-origin request volume per user session to identify programmatic exfiltration attempts.
Correlate authenticated Prefect API access with browser referrers to detect unauthorized origins.

How to Mitigate CVE-2024-8183

Immediate Actions Required

Upgrade Prefect to a version that includes commit a69266e and exposes the CORS settings.
Set PREFECT_SERVER_CORS_ALLOWED_ORIGINS to an explicit comma-separated allowlist of trusted UI hostnames.
Restrict PREFECT_SERVER_CORS_ALLOWED_METHODS and PREFECT_SERVER_CORS_ALLOWED_HEADERS to the minimum required for the Prefect UI.
Revoke and reissue any API tokens that may have been exposed to untrusted browsers.

Patch Information

The fix is delivered in commit a69266e077169b8a32ad76b1dd3ea63b96d011c2. It introduces three new settings — PREFECT_SERVER_CORS_ALLOWED_ORIGINS, PREFECT_SERVER_CORS_ALLOWED_METHODS, and PREFECT_SERVER_CORS_ALLOWED_HEADERS — and replaces the hardcoded wildcard values in the CORSMiddleware registration. Additional context is available in the Huntr Bounty Report.

Workarounds

Front the Prefect API with a reverse proxy that rewrites or strips permissive CORS response headers.
Bind the Prefect server to an internal network and require VPN or zero-trust access to reach the UI.
Enforce short-lived authentication sessions to reduce the window in which a cross-origin attack can succeed.

bash

# Configuration example: restrict CORS to trusted origins
export PREFECT_SERVER_CORS_ALLOWED_ORIGINS="https://prefect.internal.example.com"
export PREFECT_SERVER_CORS_ALLOWED_METHODS="GET,POST,PATCH,DELETE,OPTIONS"
export PREFECT_SERVER_CORS_ALLOWED_HEADERS="Authorization,Content-Type,X-PREFECT-API-VERSION"