Cybersecurity Issue: OWASP A01:2021 Broken Access Control

Report a Bug
1

I believe it’s a general issue.

Description
As our client requested, we ran a Vulnerability Assessment, targeting the web-admin and web-client side.

The result shows that Glide Apps has multiple medium-risk issues; one of them is OWASP A01:2021 Broken Access Control.

How to replicate

  1. Open any of your Glide App web-client or web-admin page.
  2. Navigate to the Internet requests. For example, in Google Chrome, open DevTools > Internet.
  3. Navigate to any request that goes to https://go.glideapps.com or https://your-app.glide.page
  4. Look up to request header.

You will find that header filled with access-control-allow-origin: *, like:

access-control-allow-origin - CORS setting wrong
access-control-allow-origin - CORS setting wrong1920×1175 224 KB

I took a quick look to other website services like WordPress, wix, Google, Facebook, etc. It seems that the issue does not exist in their web service.

3

@NoCodeAndy @comm_support_agent