Sumeru Cyber Security
  • Sumeru Cyber Security
  • Workarounds for prevalent vulnerabilities
    • Version Disclosure
    • Host Header Attack
    • HttpOnly and Secure Flag
    • Security Headers
    • Clickjacking
    • Weak Password
    • Username Enumeration
    • jQuery Outdated
    • Cross-Origin Resource Sharing
    • AWS S3 Bucket Misconfiguration
    • Directory Listing
    • Laravel Debug Enabled
    • Autocomplete and Remember Password Enabled
    • Brute Force Attack
    • Cross Site Request Forgery
    • SQL Injection
    • PhpMyAdmin page Available Publicly
    • Implementation of BASIC Authentication
    • Cache Browsing
    • Insecure Direct Object Reference
    • Active mixed content over https
    • Improper forgot password implementation
    • ASP.NET Debug Enabled
    • Sensitive Data Sent in GET Request
    • Weak CAPTCHA Implementation
    • Csv Injection
    • Cross Site Scripting
    • Web Server Robot.txt Information Disclosure
    • SSL Related Issues
    • Local File Inclusion
    • Weak CAPTCHA Implementation
    • Automated Form Submission
    • Php.ini File Available Publicly
    • ITLP
    • Internal Path Disclosure
    • Insecure Direct Object Reference
    • Access Token Not Expiring After Logout
  • OWASP A09-Security Logging and Monitoring Failures
  • OWASP API09-Improper Inventory Management v1.0
Powered by GitBook
On this page
  • Introduction
  • How to test?
  • Type 1
  • Type 2
  • Type 3
  • Solution

Was this helpful?

  1. Workarounds for prevalent vulnerabilities

Cross-Origin Resource Sharing

PreviousjQuery OutdatedNextAWS S3 Bucket Misconfiguration

Last updated 5 years ago

Was this helpful?

Introduction

Initially Ajax requests have traditionally been restricted by the Same Origin Policy which only allowed them to make request to resources within the same domain. HTML5 breaks this restriction and allows for Ajax requests to be made across domains.Cross-origin resource sharing (CORS) is a mechanism that allows restricted resources on a web page to be requested from another domain.

How to test?

Type 1

The implemented Cross Origin Resource Sharing (CORS) allows wildcard ( * ) as a response in header "Access-Control-Allow-Origin" which may lead to leaking of sensitive data to unauthorized locations as the origin header is not configured with exact domains. It Leads to an Misconfigured CORS

Steps

  1. Go to the respective site (eg: )

  2. Open Burp suite Community Edition. Here, is the to configuration on your browser.

  3. In burp suite, go to proxy tab and go to HTTP history. Then sent any request to the repeater by right click on the packet.

Type 2

In Request Whatever domain for eg:www.example.com should not reflect in the Access-Control-Allow-Origin response header.

GET /bWAPP/secret-cors-1.php HTTP/1.1
Host: 192.168.56.102
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Origin: www.example.com
Cookie: security_level=0; PHPSESSID=ott1h8b6hliiqbga7khh2pm430; acopendivids=swingset,jotto,phpbb2,redmine; acgroupswithpersist=nada
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu) mod_mono/2.4.3 PHP/5.3.2-1ubuntu4.30 with Suhosin-Patch proxy_html/3.0.1 mod_python/3.3.1 Python/2.6.5 mod_ssl/2.2.14 OpenSSL/0.9.8k Phusion_Passenger/4.0.38 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.2-1ubuntu4.30
Access-Control-Allow-Origin: www.example.com
Vary: Accept-Encoding
Content-Length: 51
Connection: close
Content-Type: text/plain

Type 3

We can exploit the CORS when the domain for eg: www.example.com in Access-Control-Allow-Origin response header which is given in the Origin Header and when Access-Control-Allow-Credentials: true is present.

GET /bWAPP/secret-cors-1.php HTTP/1.1
Host: 192.168.56.102
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Origin: www.example.com
Cookie: security_level=0
HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu) mod_mono/2.4.3 PHP/5.3.2-1ubuntu4.30 with Suhosin-Patch proxy_html/3.0.1 mod_python/3.3.1 Python/2.6.5 mod_ssl/2.2.14 OpenSSL/0.9.8k Phusion_Passenger/4.0.38 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.2-1ubuntu4.30
Access-Control-Allow-Origin: www.example.com
Access-Control-Allow-Credentials: true
Vary: Accept-Encoding
Content-Length: 51
Connection: close
Content-Type: text/plain

Solution

To use a whitelist of trusted domains for eg: www.example.com rather than using a wildcard or programmatically verifying supplied origins.i.e Origin header Should be validated with the specified domain like if the origin header matches ''. If yes, it returns Access-Control-Allow-Origin: .

http://example.com
http://example.com
http://192.168.56.102/bWAPP/secret-cors-1.php
Blog