T09 · Insecure Skill Coding Practices
Error
- Location
- README.md:14
- Finding
- Wildcard CORS Policy Exposes the Local Ollama API to Untrusted Websites## Vulnerability Details **File Location**: `README.md`, lines 14–29 **Vulnerability Type**: Unrestricted cross-origin access to a local API **Risk Level**: High The guide instructs users to configure `OLLAMA_ORIGINS` as `*`, both temporarily and as a persistent user environment variable: ```powershell ### Via PowerShell (temporary): $env:OLLAMA_ORIGINS = "*" ollama serve ``` ```text ### Via System Settings (permanent): 1. Open System Properties → Environment Variables 2. Under User variables, click New 3. Variable name: OLLAMA_ORIGINS 4. Variable value: * 5. Restart Ollama ``` ### Technical Analysis CORS controls which browser origins may read responses from and interact with the Ollama HTTP API. Setting `OLLAMA_ORIGINS` to `*` permits requests from every website origin rather than limiting access to the intended local web application. Ollama commonly exposes a local HTTP API without a separate authentication layer. When wildcard CORS is enabled, JavaScript hosted on an attacker-controlled website may be able to issue accepted cross-origin requests to that API while the victim browses the site. The permanent configuration increases the exposure window because the unsafe policy remains active across later Ollama sessions. The vulnerability is especially significant if Ollama is also configured to listen on a network-accessible interface. However, even a loopback-only service can be targeted by browser code running on a remote website because the requests originate from the victim's browser. ### Attack Path 1. A user follows the documented instructions and sets `OLLAMA_ORIGINS` to `*`. 2. The user starts Ollama, exposing its local HTTP API with unrestricted browser-origin access. 3. The user visits an attacker-controlled or compromised website. 4. JavaScript on that website sends cross-origin requests from the browser to the local Ollama endpoint. 5. Because every origin is allowed, Ollama accepts the website's origin and the browser permits the cross- ...[truncated 1083 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the wildcard with the exact trusted web application origin. For example: ```powershell $env:OLLAMA_ORIGINS = "http://localhost:3000" ollama serve ``` 2. If multiple front ends are required, explicitly enumerate only the origins that Ollama supports rather than using `*`. 3. Keep Ollama bound to the loopback interface unless remote network access is an explicit requirement. 4. If network access is necessary, place Ollama behind an authenticated reverse proxy, enforce TLS, and restrict inbound connections with host firewall rules. 5. Avoid presenting wildcard CORS as a general or permanent fix. Document it only as a short-lived diagnostic option, accompanied by a clear security warning. 6. Advise users to restart Ollama after narrowing the origin policy and verify that requests from unapproved origins are rejected. 7. Remove any persistent `OLLAMA_ORIGINS=*` user environment variable after troubleshooting is complete.