Too Broad Cors Policy

ID

python.too_broad_cors_policy

Severity

critical

Resource

Misconfiguration

Language

Python

Tags

CWE:942, NIST.SP.800-53, OWASP:2021:A5, PCI-DSS:6.5.10

Description

By default, same-origin policy blocks cross-origin HTTP requests initiated by scripts. There are several use cases that require cross-origin script access; for example, Content Delivery Networks (CDNs) that provide hosting for JavaScript/CSS libraries and public API endpoints. However, cross-origin access presents a major security risk and must be carefully controlled.

This detector aims to pinpoint scenarios where Cross-Origin Resource Sharing (CORS) policies are excessively permissive, potentially exposing the application to cross-origin attacks.

More specifically this detector identifies configurations that improperly set values for the Access-Control-Allow-Origin HTTP header.

Rationale

Cross-Origin Resource Sharing (CORS) is a fundamental security feature that controls how resources can be requested from a different domain.

This vulnerability arises when the Origin header is set to overly permissive values such as * or null, which effectively allows any domain to access resources, bypassing the intended security restrictions. This can lead to undesired information disclosure or unauthorized actions through a variety of attack vectors.

In addition, dynamically reflecting origins (e.g. the Origin request header) from cross-origin requests without strict validation should be avoided, as it is readily exploitable.

Example of insecure configuration using Flask and flask_cors:

from flask import Flask
from flask_cors import CORS

app = Flask(__name__)
CORS(app)  # Insecure: allows requests from any origin

This configuration enables any domain to interact with the application, which is rarely appropriate for production environments, particularly when sensitive data or operations are involved.

Remediation

To remediate this vulnerability, it is crucial to tighten the CORS policy by explicitly specifying trusted domains or origins that are permitted to interact with the application. This minimizes unauthorized access and limits the exposure to potential attacks.

Here are practical steps for safer CORS configuration in web applications:

  1. Identify the trusted domains that require cross-origin access to your resources and specify them explicitly instead of using a wildcard character.

  2. Use configuration files or security frameworks to centralize and manage CORS settings to ensure consistency across your application.

  3. Regularly review and update the list of allowed origins based on your current security requirements and business needs.

Configuration

The detector has the following configurable parameters:

  • tooBroadOriginPattern, that indicates the regex used to determine if the origin is too broad.

References