CORS Header
ID |
cors_header |
Severity |
critical |
Kind |
Access Control |
CWE |
942 |
Description
-
CORS Header: Cross-Origin Resource Sharing (CORS) is an HTTP-header based mechanism that allows a server to indicate any other origins (domain, scheme, or port) than its own from which a browser should permit loading of resources. It relaxes the Same-Origin Policy (SOP).
-
CORS Misconfiguration: This CORS misconfiguration could allow an attacker to perform AJAX queries to the vulnerable website from a malicious page loaded by the victim’s user agent. In order to perform authenticated AJAX queries, the server must specify the header "Access-Control-Allow-Credentials: true" and the "Access-Control-Allow-Origin" header must be set to null or the malicious page’s domain. Even if this misconfiguration doesn’t allow authenticated AJAX requests, unauthenticated sensitive content can still be accessed (e.g intranet websites). A malicious page can belong to a malicious website but also a trusted website with flaws (e.g XSS, support of HTTP without TLS allowing code injection through MITM, etc).
-
CORS Misconfiguration: This CORS misconfiguration could allow an attacker to perform AJAX queries to the vulnerable website from a malicious page loaded by the victim’s user agent. In order to perform authenticated AJAX queries, the server must specify the header "Access-Control-Allow-Credentials: true" and the "Access-Control-Allow-Origin" header must be set to null or the malicious page’s domain. Even if this misconfiguration doesn’t allow authenticated AJAX requests, unauthenticated sensitive content can still be accessed (e.g intranet websites). A malicious page can belong to a malicious website but also a trusted website with flaws (e.g XSS, support of HTTP without TLS allowing code injection through MITM, etc).
Rationale
CORS misconfigurations allow malicious websites to make authenticated cross-origin requests to vulnerable applications and read the responses, bypassing the Same-Origin Policy protection. When Access-Control-Allow-Origin is set to null, a wildcard, or reflects the requesting origin combined with Access-Control-Allow-Credentials true, attackers can craft malicious pages that perform AJAX requests using the victim’s cookies or credentials. This enables theft of sensitive data from authenticated sessions, CSRF attacks with response access, and extraction of API keys or personal information from intranet applications accessible only to authenticated users.