Testing a website i am in this scenario, i found a CORS endpoint that allows any subdomains to access it, so for example:

Real request:

Origin: https://abc.realwebsite.com   --->
access-control-allow-origin: https://abc.realwebsite.com

but as it accepts every subdomain i am able to change it like this:

Modified request:

Origin: https:/mywebsite.com/hey.realwebsite.com   --->
access-control-allow-origin: https:/mywebsite.com/hey.realwebsite.com

Is it possible to exploit this? How would the origin header handle a directory instead of a domain? How can i reproduce this to make a proof that it is exploitable.

  • 1
    "How can i reproduce this to make a proof that it is exploitable." - likely you can't. The browser sets the Origin header to only the domain and you cannot change this. And outside the browser CORS is irrelevant. Commented Nov 9, 2019 at 19:44

1 Answer 1


First thing: unless the CORS headers also allow credentials or are on a server that isn't supposed to be accessible from arbitrary IP addresses (or returns different content depending on the request source), this isn't really a vulnerability at all. If the browser cannot make authenticated requests (or at least not see the responses), then it can't do anything that the attacker couldn't do by just using curl on their own computer.

Next, the Origin header is only controlled by the browser, not the user. An attacker cannot cause a request to be sent with a custom origin, nor is there any circumstance where the browser would send an origin containing a path (protocol, port (if non-default), and domain only). As such, the server properly ought to be rejecting your requests as invalid, but what you've demonstrated is not exploitable in any way.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .