Covered by FixVibehigh

ZXCVVAKATAWASEWASEGI0. Na veivakadonui cala: Na leqa ni veivakadonui vakasivia na lawatu ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE1 Vulica na sala e rawa kina vei ira na dauvakacaca me ra vakawalena na lawatu ni Same-Origin ka butakoca na itukutuku bibi ni vakayagataki mai na veiqaravi ni itukutuku e buli mai na ZXCVFIXVIBETOKEN1ZXCV. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE2. Na veiwasei ni ivurevure ni kauveilatai (CORS) e dua na iwalewale ni barausa e vakarautaki me vakaceguya na lawatu ni ivurevure vata ga (SOP). E dina ni gadrevi me baleta na apps ni itukutuku ni gauna oqo, na kena vakayacori sega ni dodonu — me vaka na kena vakavotukanataki na ulutaga ni itekitekivu ni kerekere se volai na itekitekivu ni 'null' —e rawa ni vakatara na vanua ca me exfiltrate na itukutuku ni vakayagataki vakaitaukei. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE3. ## Veivakaleqai ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE4. E rawa ni butakoca e dua na dauvakacaca na itukutuku bibi, vakadeitaki mai vei ira na vakayagataka e dua na ivolakerekere malumalumu CORS. Kevaka e dua na dauvakayagataka e sikova e dua na itukutuku ca ni sa curu yani ki na app malumalumu, na vanua ca e rawa ni cakava na kerekere ni kauveilatai ki na app ni ZXCVFIXVIBETOKEN4ZXCV ka wilika na isau ni ZXCVFIXVIBETOKEN1ZXCVZXCVFIXVIBETOKEN2ZXCV. Oqo e rawa ni vakavuna na butakoci ni itukutuku vakaitaukei, oka kina na itukutuku ni vakayagataki, ivakatakilakila ni CSRF, se itukutuku vakaitaukei ZXCVFIXVIBETOKEN3ZXCV. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEGA5. ## Vuna ZXCVVAKATAWASEWASEI ZXCVVAKAVUVULI6. ZXCVFIXVIBETOKEN2ZXCV e dua na iwalewale yavutaki ena HTTP-ulutaga ka rawa kina vei ira na dauveiqaravi me ra vakaraitaka na itekitekivu cava (vanua, ituvatuva, se na toba) e vakatarai me ra vakavodoki kina na ivurevure CORS. Na malumalumu e dau basika ni sa rui veisautaki se sega ni vinaka na kena vakayacori na lawatu ni dua na dauveiqaravi: ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE77. * Vakaraitaki na ulutaga ni itekitekivu: Eso na dauveiqaravi wilika na ulutaga ni CORS mai na dua na kerekere ni kasitama ka vakavotukanataka lesu tale ena ulutaga ni isau ni ZXCVFIXVIBETOKEN1ZXCV (ACAO) ZXCVFIXVIBETOKEN2ZXCV. Oqo e vakatara vakavinaka e dua na itukutuku me rawata na ivurevure ZXCVFIXVIBETOKEN3ZXCV. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEG8. * Wildcards cala: Ni sa vakatara na CORS wildcard e dua na itekitekivu me rawata e dua na ivurevure, e sega ni rawa ni vakayagataki me baleta na kerekere e gadrevi kina na ivakadinadina (me vaka na bisikete kamica se na ulutaga ni veivakadonui) ZXCVFIXVIBETOKEN1ZXCV. Era dau tovolea na dauvakatorocaketaka me ra vakawalena oqo ena nodra vakatubura na ulutaga ni ACAO ka yavutaki ena kerekere ZXCVFIXVIBETOKEN2ZXCV. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASE9. * Lisi vulavula 'null': Eso na ivolakerekere vulavula na itekitekivu ni CORS, ka rawa ni vakavuna na kerekere vakavoutaki se na faile ni vanua, vakatara na vanua ca me masquerade me vaka e dua na itekitekivu ni ZXCVFIXVIBETOKEN1ZXCV me rawati kina na curu ZXCVVAKATAWASEWASEIVEIVAKATAWASEWASE2ZXCVZXCVVAKATAWASEWASEAVEIVAKATAWASEWASEI3ZXCV. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI10 * Parsing cala: Na cala ena regex se na veitaratara ni string ena gauna e vakadeitaki kina na ulutaga ni CORS e rawa ni vakatara na dauvakacaca me ra vakayagataka na vanua me vaka na ZXCVFIXVIBETOKEN1ZXCV. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI11 E bibi me da kila ni ZXCVFIXVIBETOKEN1ZXCV e sega ni dua na itataqomaki mai na Kauveilatai-vanua ni kerekere ni veivakaisini (CSRF) CORS. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI12 ## Vakavinakataki ni simede ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI13 * Vakayagataka e dua na lisi vulavula ni Static: Me kua ni vakatuburi na ulutaga ni CORS mai na ulutaga ni ZXCVFIXVIBETOKEN2ZXCV ni kerekere. Ia, vakatauvatana na itekitekivu ni kerekere me baleta e dua na lisi hardcoded ni veivanua nuitaki ZXCVFIXVIBETOKEN3ZXCV. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI14 * Vakatabuya na 'null' iVakavuvuli: Kakua vakadua ni okati kina na ZXCVVAKAVUVULI 0ZXCV ena nomu lisi vulavula ni ivurevure vakatarai ZXCVVIXVIBABITOKEN1ZXCV. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI15 * Vakatabui na ivakadinadina: Vakarautaka ga na ZXCV kevaka e gadrevi sara ga me baleta na veimaliwai vakatabakidua ni kauveilatai-ivurevure ZXCV. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI16 * Vakayagataka na veivakadeitaki dodonu: Kevaka e dodonu mo tokona e vuqa na itekitekivu, vakadeitaka na vakasama ni veivakadeitaki me baleta na ulutaga ni CORS e kaukauwa ka sega ni rawa ni vakawaleni mai na veivanua lalai se veivanua tautauvata-rairai ZXCVFIXVIBETOKEN1ZXCV. ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI17 ## Na sala e vakatovolei kina ZXCVVAKATAWASEWASEI ZXCVVAKATAWASEWASEI18 ZXCV sa okati kina oqo me vaka e dua na jeke ni cakacaka gated. Ni oti na veivakadeitaki ni vanua ni, CORS vakauta na kerekere vata ga-itekitekivu ZXCVFIXVIBETOKEN2ZXCV vata kei na dua na itekitekivu ni dauvakacaca vakaidewadewa ka railesuva na ulutaga ni isau ni ZXCVFIXVIBETOKEN4ZXCV. E ripotetaka na itekitekivu ni veivakaduiduitaki, wildcard vakadeitaki ZXCVFIXVIBETOKEN5ZXCV, kei na rabailevu-dolava na ZXCVFIXVIBETOKEN6ZXCV ena sega ni lewenivanua ZXCVFIXVIBETOKEN3ZXCV itinitini ni vakatabui na rorogo ni iyau ni lewenivanua.

Cross-Origin Resource Sharing (CORS) is a browser mechanism designed to relax the Same-Origin Policy (SOP). While necessary for modern web apps, improper implementation—such as echoing the requester's Origin header or whitelisting the 'null' origin—can allow malicious sites to exfiltrate private user data.

CWE-942

Impact

An attacker can steal sensitive, authenticated data from users of a vulnerable application [S2]. If a user visits a malicious website while logged into the vulnerable app, the malicious site can make cross-origin requests to the app's API and read the responses [S1][S2]. This can lead to the theft of private information, including user profiles, CSRF tokens, or private messages [S2].

Root Cause

CORS is an HTTP-header based mechanism that allows servers to specify which origins (domain, scheme, or port) are permitted to load resources [S1]. Vulnerabilities typically arise when a server's CORS policy is too flexible or poorly implemented [S2]:

Reflected Origin Header: Some servers read the Origin header from a client request and echo it back in the Access-Control-Allow-Origin (ACAO) response header [S2]. This effectively allows any website to access the resource [S2].
Misconfigured Wildcards: While the * wildcard allows any origin to access a resource, it cannot be used for requests that require credentials (like cookies or Authorization headers) [S3]. Developers often try to bypass this by dynamically generating the ACAO header based on the request [S2].
Whitelisting 'null': Some applications whitelist the null origin, which can be triggered by redirected requests or local files, allowing malicious sites to masquerade as a null origin to gain access [S2][S3].
Parsing Errors: Mistakes in regex or string matching when validating the Origin header can allow attackers to use domains like trusted-domain.com.attacker.com [S2].

It is important to note that CORS is not a protection against Cross-Site Request Forgery (CSRF) [S2].

Concrete Fixes

Use a Static Whitelist: Avoid dynamically generating the Access-Control-Allow-Origin header from the request's Origin header [S2]. Instead, compare the request's origin against a hardcoded list of trusted domains [S3].
Avoid the 'null' Origin: Never include null in your whitelist of allowed origins [S2].
Restrict Credentials: Only set Access-Control-Allow-Credentials: true if absolutely necessary for the specific cross-origin interaction [S3].
Use Proper Validation: If you must support multiple origins, ensure the validation logic for the Origin header is robust and cannot be bypassed by subdomains or similar-looking domains [S2].

How FixVibe tests for it

FixVibe now includes this as a gated active check. After domain verification, active.cors sends same-origin API requests with a synthetic attacker origin and reviews CORS response headers. It reports reflected arbitrary origins, wildcard credentialed CORS, and wide-open CORS on non-public API endpoints while avoiding public asset noise.