Dify CORS Misconfiguration Vulnerability in the Setup API Endpoint

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify version 1.9.1, specifically within the '/console/api/setup' endpoint. This vulnerability arises from an insecure CORS policy that indiscriminately reflects any Origin header and allows 'Access-Control-Allow-Credentials: true'. As a result, arbitrary external domains can make authenticated requests to the endpoint.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive installation and setup information by allowing external domains to make authenticated requests to the vulnerable endpoint.