2

Bug description 1.2.2/1.2.10/1.4.0/1.5.1/1.5.2/1.5.3/1.5.4/1.6.0 - allowOrigins not blocking curl requests from different origins. Security vulnerability scan has detected this. When I curl if a domain match I get it as access-control-allow-origin: https://testthat.com, but if doesn't match I get access-control-allow-origin: *. I am expecting the request to be blocked.

Expected behavior The specified origin unless being set to * should block everything else exclusively.

Steps to reproduce the bug Create a virtual service with CORS allowOrigins set to https://testthat.com, simulate REST API to the service behind it assuming another ORIGIN and the request will return 200.

On 1.6.0 I am using the virtualservice below to whitelist only single domain and with the following curl I am receiving 200 on a different, why isn't it blocked: curl -X OPTIONS 'https://api2.qa.testthat.com/v1/test/something' -H "Origin: https://testthat.com" -v

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  labels:
    app.kubernetes.io/instance: qa-bom
    app.kubernetes.io/managed-by: Tiller
    app.kubernetes.io/name: service-test
    helm.sh/chart: service-test-0.1.0-release-2-7-0-4-227fd9a
  name: service-test
  namespace: qa
spec:
  gateways:
  - api-gateway
  hosts:
  - service-test
  - api2.qa.testthat.com
  http:
  - corsPolicy:
      allowHeaders:
      - Authorization
      - Content-Type
      allowMethods:
      - POST
      - GET
      - PUT
      - PATCH
      - DELETE
      allowOrigins:
      - exact: https://testthat.com
    match:
    - gateways:
      - api-gateway
      method:
        regex: GET|OPTIONS
      uri:
        regex: /v1/test/.*
    route:
    - destination:
        host: service-test
        port:
          number: 8080
        subset: active
      weight: 100

Version (include the output of istioctl version --remote and kubectl version and helm version if you used Helm)

./istioctl version --remote
client version: 1.6.0
control plane version: 1.6.0
data plane version: 1.6.0 (57 proxies)
 kubectl version
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1", GitCommit:"b7394102d6ef778017f2ca4046abbaa23b88c290", GitTreeState:"clean", BuildDate:"2019-04-08T17:11:31Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.3", GitCommit:"5e53fd6bc17c0dec8434817e69b04a25d8ae0ff0", GitTreeState:"clean", BuildDate:"2019-06-06T01:36:19Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}
helm version
Client: &version.Version{SemVer:"v2.13.0", GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.13.0", GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6", GitTreeState:"clean"}
cat /etc/*release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.4 LTS"
NAME="Ubuntu"
VERSION="18.04.4 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.4 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic

How was Istio installed? https://istio.io/docs/setup/install/standalone-operator/'

Environment where bug was observed (cloud vendor, OS, etc) On-premise Ubuntu OS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.