1

When I make a cross origin request to example.com from anysite.com with

req.withCredentials = "true";

cookies are included in the request

The response contains

access-control-allow-origin: https://anysite.com
access-control-allow-credentials: true
access-control-expose-headers: WWW-Authenticate,Server-Authorization

In this particular case, cookies values can be used to calculate the Authorization header value that can be obtained by manipulating cookie values.

I just want to extract cookies.

Any idea how to do that?

The target site doesn't have a CRLF vulnerability.

Improve this question
3
  • I take it that "example.com" requires this authentication sent in a separate header, rather than just using session cookies? Normally CORS configured like that allows you to basically "remote control" the victim's session n the vulnerable site, and it doesn't matter what the cookies actually are, only that the victim's browser have them be set.
    – CBHacking
    Nov 22, 2018 at 5:32
  • @Doe: I've noticed that you changed my edit (CRLF into CSRF) back. While it is widely known what a CSRF vulnerability is I think you need to explain what this CRLF vulnerability should be if you insist that you mean CRLF and not CSRF.
    – Steffen Ullrich
    Nov 24, 2018 at 11:53
  • owasp.org/index.php/CRLF_Injection
    – Doe
    Nov 25, 2018 at 15:38

1 Answer 1

Reset to default
2

An attacker might influence what gets sent within a cross-origin request but he is not able to read the cookies which gets added by the browser to the cross-origin request. Even a wide open CORS policy does not change this.

An attacker might also not change where the cookies get send: cookies will only be sent to the site where they belong to, no matter what CORS policy exists.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .