cors-misconfiguration

name	cors-misconfiguration
description	Detect Cross-Origin Resource Sharing misconfigurations that allow credential theft
domain	web-security
subdomain	cors
tags	["web","cors","headers","cross-origin"]
version	1.0.0
author	BerkahKarya
license	MIT

CORS Misconfiguration Detection

When to use

Apply this skill when testing web applications and APIs for CORS policy errors that could enable cross-origin data theft.

Detection steps

1. Identify API endpoints: Look for endpoints returning sensitive data (user info, tokens, PII) — typically under /api/.
2. Send arbitrary Origin: Send a request with Origin: https://evil.com and inspect the Access-Control-Allow-Origin (ACAO) and Access-Control-Allow-Credentials (ACAC) response headers.
3. Check for reflection: If the ACAO header reflects the supplied Origin (or uses * with credentials), the CORS policy is misconfigured.
4. Test null origin: Send Origin: null — some applications allow null origins (exploitable via sandboxed iframes).
5. Test subdomain bypass: If the app allows *.example.com, test a subdomain like evil.example.com.
6. Test preflight: Send an OPTIONS preflight with custom headers and verify the allowed methods/headers.

Dangerous configurations

• Access-Control-Allow-Origin: * + Access-Control-Allow-Credentials: true (invalid but some servers send it)
• Access-Control-Allow-Origin: <reflected origin> + Access-Control-Allow-Credentials: true
• Access-Control-Allow-Origin: null + Access-Control-Allow-Credentials: true

Common payloads

# Test arbitrary origin reflection
curl -sI "https://target.com/api/user" -H "Origin: https://evil.com" | grep -i access-control

# Test null origin
curl -sI "https://target.com/api/user" -H "Origin: null" | grep -i access-control

False positive indicators

• ACAO is * but ACAC is not true — browsers block credentialed cross-origin requests
• The application allows a specific allowlist of trusted origins, not arbitrary reflection
• The endpoint returns only public data (no credentials needed, no sensitive info)

Reporting

Include the HTTP response headers showing the reflected origin and credentials flag, plus a JavaScript PoC that reads the response from a malicious origin.