CORS Misconfiguration

What Is Broken and Why

Cross-Origin Resource Sharing (CORS) extends the same-origin policy to allow controlled cross-origin requests. Misconfigurations arise when servers reflect arbitrary Origin values in Access-Control-Allow-Origin without validation, allow null origins (exploitable via sandboxed iframes), or combine Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true (which browsers reject per spec but server-side logic may still honor insecurely). An attacker exploiting a CORS misconfiguration can read authenticated API responses from a victim's browser, leaking session data, PII, CSRF tokens, and other sensitive information.

Key Signals

• Access-Control-Allow-Origin mirrors the Origin request header verbatim
• Access-Control-Allow-Origin: * on endpoints returning sensitive data (even without credentials, if the data is public-sensitive)
• Access-Control-Allow-Credentials: true combined with origin reflection
• Access-Control-Allow-Origin: null — exploitable via sandboxed iframe
• Wildcard subdomain trust: any *.example.com origin accepted, including attacker-controlled subdomains
• Missing Vary: Origin header indicating improper caching of CORS responses