Exploiting CORS Misconfigurations for Bitcoins and Bounties
summary
Shows concrete exploits: CORS dynamic allow-origin logic and the null origin let attackers steal API keys and take over accounts, enabling full Bitcoin withdrawals from two exchanges and market manipulation; automated scanning finds these low-hanging fruit, one exchange fixes a report in 20 minutes. Demonstrates bypassing Google HTTPS protections via HTTP-origin interception, server-side cache poisoning and header injection to turn unexploitable reflection into persistent XSS, cites an Intelli/localhost proxy RCE that earned a $50,000 bounty and a Burp Suite update that automates detection.
AI-written summary · about
chapters (5)
related talks
25mWe Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS
28mOffensive and Defensive Strategies for Client-Side JS Security
43mAttacking Modern Web Technologies
56mModern Web Vulnerabilities 2020
58mExploiting web messaging implementations
50mHTTP Desync Attacks: Smashing into the Cell Next Door
42mModern web application bugs
45mSame Origin Method Execution (SOME) - Exploiting a Callback for Same Origin Policy Bypass