I recently found the following HTTP headers on a site that could at the very least be described as a high value target:
Access-Control-Allow-Origin: http://localhost:8888
Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: [some custom non-standard headers]
This looks weird to me, or at least not compliant with the CORS RFC:
The Access-Control-Allow-Origin header indicates whether a resource can be shared based by returning the value of the Origin request header, "*", or "null" in the response.
The returned value is obviously not my Origin request header (or *
or null
). So, my questions are:
- Is there any good reason for sending these headers? To me it seems like something used in testing that have accidentally leaked into production.
- Is it possible to exploit this in any way? Seems unlikely to me, since only a tiny minority of users will have anything running on that port, plus an attacker would not be able to control it anyway. But maybe I am overlooking something.
- Is this something that warrants contacting the site in question to inform them about the issue?