We Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS
summary
Empirical analysis of CORS finds concrete, exploitable failures: a content-type prefix bypass lets crafted headers deliver payloads that obtained a remote shell on an Apache server; oversized header probing plus a timing channel lets attackers infer cookie presence across origins; permissive body and header handling enables cross-origin requests that create local files via FTP interactions. The study scans popular domains, reports 400,000 subdomains configured with CORS and finds 27% insecure configs, proposes fixes now adopted by the spec and major browsers and publishes an open-source test tool.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:43Same Origin Policy (SOP)
- 1:15Developers need cross origin reading
- 3:10The default SOP prevents cross origin reading
- 3:24Cross origin resource sharing (CORS)
- 4:39Simple requests in CORS standard
- 5:32Overly permissive request headers and bodies
- 6:05Overly permissive header values
- 7:26Case study: obtain a shell on Intranet server
- 8:13Few limitations on header size
- 11:28Overly flexible body values
- 12:27Demo: exploiting Macos built-in Apple file server to create local files
- 13:29How does CORS policy work?
- 14:33Origin reflection
- 15:03Validation mistakes
- 17:19CORS measurement
- 18:00Measurement results
- 18:35Response by CORS standard organization
- 20:29Summary
related talks
40mMisconfigured CORS and why web appsec is not getting easier
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery
46mExploiting CORS Misconfigurations for Bitcoins and Bounties
13mCORS: Cross-domain requests with JavaScript
37mA Hipster History of CORS
18mCORS, XSS, CSRF, SQL injection #BackToTheBasics
18mWriting an (in)secure webapp