CORS misconfiguration

When it applies

An endpoint returns sensitive data and sets CORS headers that let an attacker origin read the response with the victim's credentials.

Why it works

CORS lets a server opt-in to cross-origin reads. If it reflects the request Origin into Access-Control-Allow-Origin and sets Access-Control-Allow-Credentials: true, any site can make the victim's browser send an authenticated request and read the response — cross-origin data theft.

Method

1. Probe: send requests with Origin: https://evil.com and inspect response headers. Vulnerable if ACAO echoes your origin (or null) AND ACAC is true.
2. Test weak allowlists: Origin: https://evil.com vs https://sub.target.com.evil.com, https://targetevil.com, null (via sandboxed iframe), and non-TLS variants — many regexes are sloppy.
3. Exploit: host JS on your origin that fetch(url, {credentials:'include'}) the sensitive endpoint and exfils the response to you; load it as the victim.