Exploiting Misconfigured CORS via Wildcard Subdomains

In last post about CORS i explained the cases where and how we can detect the presence of CORS misconfiguration, so this post will cover the one of specific case from them.

So last week while testing one of web application for CORS misconfiguration, i came across a scenario and this is how it looks like:

Request 1#

Response 1#

Request 2#

Response 2#

Request 3#

Response 3#

Request 4#

Response 4#

so from request 1-3 we can see, the ACAO is properly set no matter from what Origin its requested, but in case 4 we can see the anything after domain name site.com is getting reflected back to ACAO header.

So i thought to exploit it, and after bit of confusion and quick tip from James cleared my doubts. so i enabled the wildcard entry for my domain geekboy.ninja.

And idea is of wildcard will work like this, now if i request anything in this manner: https://site.com.geekboy.ninja/exploit.html, it will valid request and exploit.html will be served from domain geekboy.ninja/exploit.html  and other side, Origin will be set as: https://site.com.geekboy.ninja which is the requirement of this case.

And this is how a small misconfiguration allows attacker to bypass the SOP of website.

Takeaways for hackers: check for every variations of Origin header, for dev: use predefined ACAO dynamically.  


do let me know if you have any question in comment section.

17 thoughts on “Exploiting Misconfigured CORS via Wildcard Subdomains

  1. Muhammad Khizer Javed says:

    Awesome post, Last post helped me alot…. and Now this one 👌 Can u share any tut on Enabling wildcard entry on my domain 🙂 Thanks

  2. gopinatg says:

    Sorry , i didnt get ” so i enabled the wildcard entry for my domain geekboy.ninja. ” want to do any setup on attackers domain?

  3. how can i get this domain from internet? can you help me to get any cheap domain. where i can create any folder , html file etc.
    i created in wordpress, there i am not able to.

    • Geekboy says:

      Hey, the 3rd case is about allowed any subdomain of the target application, you can exploit it if you XSS on 1 on the subdomain on the target application otherwise NOT.

  4. Vik says:

    Nice post. I came across one application which makes use of CORS. I am able to get the origin header set in the request in the response of Allow-Origin header. Its similar for request and response 2 & 3 as highlighted in the post. Is it still an issue and should be reported?

Leave a Reply

Your email address will not be published. Required fields are marked *