CVE-2021-32091: 
Python vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability (CVE-2021-32091) was discovered in StackLift LocalStack version 0.12.6. LocalStack is a popular open source application that provides an easy-to-use test framework for cloud applications, enabling users to host AWS cloud setups in local networks for developing and testing cloud and serverless apps (Sonar Blog, Daily Swig).

The vulnerability exists due to unsanitized HTTP response handling in LocalStack. When combined with Server-Side Request Forgery (SSRF), an attacker can send an XSS payload as a response via a controlled server, leading to a persistent Cross-Site Scripting vulnerability. The application explicitly allows cross-origin requests through any page by setting special HTTP headers in the response, which enables attackers to detect and attack LocalStack instances through XHR responses (Sonar Blog).

When exploited, this vulnerability can be chained with other vulnerabilities (SSRF) to achieve complete compromise of local instances and execute arbitrary system commands. The vulnerability allows attackers to bypass modern browser CORS restrictions and potentially steal sensitive data from the test cloud, including AWS Cloud authorization headers (Sonar Blog, Daily Swig).

Despite being a local application, the vulnerability can be exploited remotely through a target user's browser. An attacker can trigger cross-site HTTP requests to the victim's local network via JavaScript code when the victim visits a malicious website. The lack of authentication in LocalStack and its CORS configuration makes the exploitation possible (Sonar Blog).

The vulnerability was reported to the vendor in October 2020, but remained unpatched in subsequent versions (v0.12.6 and v0.12.7) as the project maintainers determined that real-world attack scenarios were limited due to LocalStack being executed on local machines (Daily Swig).

Security researchers from Sonarsource emphasized that while real-world attacks against local instances are less likely than against directly exposed applications, developers should be aware of these risks to protect their setups and write secure code for their own applications (Sonar Blog).