QID 150630

Date Published: 2023-03-08

QID 150630: CORS header misconfigured

Cross-Origin Resource Sharing (CORS) is an HTTP-header based mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources. CORS also relies on a mechanism by which browsers make a "preflight" request to the server hosting the cross-origin resource, in order to check that the server will permit the actual request. In that preflight, the browser sends headers that indicate the HTTP method and headers that will be used in the actual request. For security reasons, browsers restrict cross-origin HTTP requests initiated from scripts. The "Access-Control-Allow-Origin" header is used to specify the allowed origins to access the resource.

The WAS scanning engine detects the vulnerability by examining the "Access-Control-Allow-Origin" header for a wildcard value (*). This value in the response to an XHR request indicate that the resource can be accessed from any domain and needs to be strictly configured.

If CORS is misconfigured, it can lead to major security risk like access to sensitive data, API keys and other users' data from any domain. This access could lead to misuse and exploitation of protected resource.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

CORS header misconfiguration can be addressed by providing only the list of allowed domains in the "Access-Control-Allow-Origin" header. The wildcard character (*) should never be provided as it indicates any domain can access the resource.

Vendor References

CVEs related to QID 150630

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].