Getting confusion that this responce indicate CORS vulnerability

Question

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 12
Connection: close
Date: Tue, 25 Sep 2018 12:59:56 GMT
x-amzn-RequestId: xxxxxxxxxxx
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type,Authorization,Accept,X-Amz- 
Date,X-Api-Key,X-Amz-Security-Token,x-client-type,x-client-version,x- 
anonymous-id
x-amz-apigw-id: xxxxxx
X-Amzn-Trace-Id: Root=xxxxxxxxx;Sampled=0
X-Cache: Miss from cloudfront
Via: 1.1 xxxxxxxxxxxxxx
X-Amz-Cf-Id: xxxxxxxxxxxxxx

{"ok": true}

I am getting confused that this response indicates CORS vulnerability.

When I send the request I have changed the Origin: evil.com and then I get above response.

Can anyone tell me if this response indicates CORS vulnerability?

Answer 1

Access-Control-Allow-Origin: *

This is only a vulnerability if cross-origin requests from everywhere should not be allowed. But an application might explicitly be designed to allow cross-origin requests from everywhere - in which case this would not be considered a vulnerability.

Since nothing is known about the specific application, it is unclear whether this is a vulnerability or not.