danswer-ai Danswer CORS Misconfiguration Vulnerability Allowing Data Theft

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability has been identified in danswer-ai/danswer version 1.4.1. This vulnerability allows attackers to steal sensitive information, including chat contents, API keys, and other data. The issue arises from improper validation of the origin header, which enables malicious web pages to make unauthorized requests to the application's API.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information such as chat contents and API keys.