Too Broad Cors Policy

ID

php.too_broad_cors_policy

Severity

critical

Resource

Misconfiguration

Language

Php

Tags

CWE:942, NIST.SP.800-53, OWASP:2021:A5, PCI-DSS:6.5.10

Description

By default, same-origin policy blocks cross-origin HTTP requests initiated by scripts. There are several use cases that require cross-origin script access; for example, Content Delivery Networks (CDNs) that provide hosting for JavaScript/CSS libraries and public API endpoints. However, cross-origin access presents a major security risk and must be carefully controlled.

This detector aims to pinpoint scenarios where Cross-Origin Resource Sharing (CORS) policies are excessively permissive, potentially exposing the application to cross-origin attacks.

More specifically this detector identifies configurations that improperly set values for the Access-Control-Allow-Origin HTTP header.

Rationale

Cross-Origin Resource Sharing (CORS) is a fundamental security feature that controls how resources can be requested from a different domain.

This vulnerability arises when the Origin header is set to overly permissive values such as * or null, which effectively allows any domain to access resources, bypassing the intended security restrictions. This can lead to undesired information disclosure or unauthorized actions through a variety of attack vectors.

In addition, dynamically reflecting origins (e.g. the Origin request header) from cross-origin requests without strict validation should be avoided, as it is readily exploitable.

Consider a PHP application with the following permissive CORS configuration:

<?php
// Insecure CORS policy allowing all origins
header("Access-Control-Allow-Origin: *");
?>

This configuration does not restrict which domains can interact with the resources, potentially exposing sensitive data to malicious domains.

Remediation

To remediate this vulnerability, it is crucial to tighten the CORS policy by explicitly specifying trusted domains or origins that are permitted to interact with the application. This minimizes unauthorized access and limits the exposure to potential attacks.

Here are practical steps for safer CORS configuration in web applications:

  1. Identify the trusted domains that require cross-origin access to your resources and specify them explicitly instead of using a wildcard character.

  2. Use configuration files or security frameworks to centralize and manage CORS settings to ensure consistency across your application.

  3. Regularly review and update the list of allowed origins based on your current security requirements and business needs.

Configuration

The detector has the following configurable parameters:

  • tooBroadOriginPattern, that indicates the regex used to determine if the origin is too broad.

References