| name | auditing-cors-policy |
| description | Audit a target's CORS posture — Access-Control-Allow-Origin handling,
reflected-origin bypass, credentials+wildcard mismatch, preflight
OPTIONS behavior, Vary header correctness.
Use when: a third-party integration is failing CORS preflight and
someone proposes "just set Allow-Origin to *" as the fix, OR your
bug-bounty inbox has a credential-reuse exploit chain.
Threshold: any reflection of arbitrary Origin into Allow-Origin,
Allow-Credentials:true with wildcard origin (browser-rejected combo
but server config wrong), missing Vary:Origin on per-origin responses,
preflight cached over 86400s, OR Allow-Origin trust of attacker-
controlled subdomain pattern.
Trigger with: "audit cors", "check cors policy", "cors bypass",
"preflight check".
|
| allowed-tools | ["Read","Bash(python3:*)","Bash(curl:*)"] |
| disallowed-tools | ["Bash(rm:*)","Edit(/etc/*)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","cors","web","pentest"] |
Auditing CORS Policy
Overview
CORS misconfiguration is one of the most common middle-severity findings
in web bug bounties. The browser-enforced rules are subtle, the failure
modes are silent (the wrong cors response just works until an attacker
weaponizes it), and the "fix" engineers reach for —
Access-Control-Allow-Origin: * — opens the very class of attacks CORS
was meant to prevent when paired with credentials.
This skill probes each common CORS misconfiguration with synthetic
Origin headers and grades the response.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| Origin reflected without validation | HIGH | Synthetic Origin https://attacker.example echoed in Allow-Origin | OWASP A05:2021 |
| Allow-Credentials:true with wildcard Allow-Origin | CRITICAL | Browser rejects but server is asserting the worst combo | OWASP A05:2021 |
| Allow-Credentials:true with reflected Origin | CRITICAL | Attacker site can read authenticated responses cross-origin | OWASP A05:2021, CWE-942 |
| Subdomain wildcard pattern bypass | HIGH | Allow-Origin: *.example.com matches attacker.example.com.evil.com | CWE-942 |
| Missing Vary:Origin on per-origin response | MEDIUM | CDN caches one origin's response for all origins | RFC 7234 |
| Preflight cache > 86400s | LOW | Access-Control-Max-Age over 24h limits revocation agility | MDN best practice |
| Null Origin trusted | HIGH | Allow-Origin: null accepted (sandboxed iframes, data: URLs) | CWE-942 |
| All HTTP methods permitted | MEDIUM | Allow-Methods: * enables CSRF-via-CORS for state-change | OWASP A05:2021 |
Prerequisites
- Python 3.9+ (
requests library)
- Authorization for non-local targets (
../analyzing-tls-config/references/AUTHORIZATION.md)
