In the following python script

    if request.method in ['POST', 'PUT', 'PATCH', 'DELETE']:
        origin = request.headers.get('Origin', None)
        if origin and not origin.startswith(request.base):
            raise cherrypy.HTTPError(403, 'Unexpected Origin header')

Explanation:

In the above lines of code, The origin is being only validated from the start of domain name only https://rdiffweb-demo.ikus-soft.com. But it isn't validated after the actual domain name https://rdiffweb-demo.ikus-soft.com .nithissh.com

For Example,

If we enter the following domain https://nithissh.com.rdiffweb-demo.ikus-soft.com as an origin and then the origin header being validated and returns a 403 status as expected in the code

But Now we can bypass the above validation check, By a creating subdomain after the soft.com.^ as follows https://rdiffweb-demo.ikus-soft.com .nithissh.com.

Impact

These kind of origin validation bypasses helps in chaining with other vulnerabilities like CSRF, XSS and Clickjack as well

Remediation

This is a snippet of regex for a user input and we can make use of this in the Origin header validation as well

import re

def use_regex(input_text):
    pattern = re.compile(r"^rdiffweb-demo\.ikus-soft\.com$", re.IGNORECASE)
    return pattern.match(input_text)