When I make a cross origin request to example.com from anysite.com with

req.withCredentials = "true";

cookies are included in the request

The response contains

access-control-allow-origin: https://anysite.com
access-control-allow-credentials: true
access-control-expose-headers: WWW-Authenticate,Server-Authorization

In this particular case, cookies values can be used to calculate the Authorization header value that can be obtained by manipulating cookie values.

I just want to extract cookies.

Any idea how to do that?

The target site doesn't have a CRLF vulnerability.

  • I take it that "example.com" requires this authentication sent in a separate header, rather than just using session cookies? Normally CORS configured like that allows you to basically "remote control" the victim's session n the vulnerable site, and it doesn't matter what the cookies actually are, only that the victim's browser have them be set. – CBHacking Nov 22 '18 at 5:32
  • @Doe: I've noticed that you changed my edit (CRLF into CSRF) back. While it is widely known what a CSRF vulnerability is I think you need to explain what this CRLF vulnerability should be if you insist that you mean CRLF and not CSRF. – Steffen Ullrich Nov 24 '18 at 11:53
  • owasp.org/index.php/CRLF_Injection – Doe Nov 25 '18 at 15:38

An attacker might influence what gets sent within a cross-origin request but he is not able to read the cookies which gets added by the browser to the cross-origin request. Even a wide open CORS policy does not change this.

An attacker might also not change where the cookies get send: cookies will only be sent to the site where they belong to, no matter what CORS policy exists.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.