Skip to main content

Cross-origin resource sharing (CORS)

Cross-origin resource sharing (CORS) 

Cross-origin resource sharing (CORS) is a browser mechanism which enables controlled access to resources located outside of a given domain. It extends and adds flexibility to the same-origin policy (SOP). However, it also provides potential for cross-domain attacks, if a website's CORS policy is poorly configured and implemented. CORS is not a protection against cross-origin attacks such as cross-site request forgery (CSRF).

Same-origin policy

The same-origin policy is a restrictive cross-origin specification that limits the ability for a website to interact with resources outside of the source domain. The same-origin policy was defined many years ago in response to potentially malicious cross-domain interactions, such as one website stealing private data from another. It generally allows a domain to issue requests to other domains, but not to access the responses.

Vulnerabilities

Many modern websites use CORS to allow access from subdomains and trusted third parties. Their implementation of CORS may contain mistakes or be overly lenient to ensure that everything works, and this can result in exploitable vulnerabilities.

Content Security Policy (CSP)

The goal of CSP is to protect against Cross-Site Scripting (XSS) attacks by dictating which scripts should be trusted and which shouldn't. When a browser tries to run a script from an unknown source, CSP will block it unless it is on the list of trusted sources. If no CSP is provided, then a site will default to using the "Same-Origin Policy" (SOP).

Sample HTB Box

  1. https://0xdf.gitlab.io/2021/03/20/htb-crossfit.html

References:

  1. https://portswigger.net/web-security/cors
  2. https://systemweakness.com/first-bug-bounty-program-found-cors-cross-origin-resource-sharing-misconfiguration-52c1bd3ebfe0
  3. https://dev.to/sophiekaelin/what-is-the-difference-between-cors-and-csp-i7n
  4. https://anweshb.medium.com/cors-explained-2a91a34f72e2
  5. https://blog.securityevaluators.com/websockets-not-bound-by-cors-does-this-mean-2e7819374acc
Back to top