Cross-Origin Resource Sharing

ALTERNATIVE NAMES

CORS

AFFECTED SYSTEMS

Web servers without CORS settings

SEVERITY

Medium

BACKGROUND

The latest browsers restrict running off-origin scripts within a site, this policy is known as Same-Origin Policy. Cross-Origin Resource Sharing is used to bypass this restriction, in order to enable CORS the header for a specific site such as Access-Control-Allow-Origin: http://www.example.com or as wildcard Access-Control-Allow-Origin: * must be set in the header. An attacker may inject this header with HTTP Header vulnerability described in this article. As a result, the attacker may reveal sensitive information or redirect the victim to the malicious sites.

SOLUTION

Avoid using wildcard **Access-Control-Allow-Origin: ***and make sure you made the necessary CORS configuration.

LEGAL

Permission is granted for the redistribution of this alert by explicitly linking the page to be referred. It may not be edited in any way without written consent.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties concerning this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this information.