I am testing a mobile app that makes calls to a REST API. The API is only used by Android and iOS apps. Apps are native apps and they do not use web views. API trusts arbitrary Origins and Access-Control-Allow-Credentials header value is set to true. API contains sensitive data and requires authentication.

If this was a browser application, a malicious app could access to user's sensitive data but I could not think of a way to achieve this from a mobile device.

Is there a way to exploit this configuration from an Android or iOS app or is CORS only relevant for browsers?

  • 2
    1. Not every CORS policy which allows access by anybody is a misconfiguration, i.e. it might actually be intended to make the API open for any cross-origin access. If such an open CORS policy is a problem depends on what the API actually provides, i.e. if cross-origin access is a problem at all. 2. CORS is a policy intended for a browser or anything behaving like a browser. Mobile apps might behave like a browser (usually be integrating a browser engine) or might be not. It is unknown how your specific mobile app behaves and thus the question cannot be answered. – Steffen Ullrich Nov 15 '19 at 20:58
  • @SteffenUllrich Hi, I updated the question, tried to make it more clear. Can you give me an example for your second point. If the mobile apps are using web views or anything like a browser, is it possible to make a cross origin request assuming there is not another vulnerability. In web apps the browsers sends the cookies with the request and allows access to the response. Is it possible with a mobile app? – mk_ Nov 15 '19 at 21:24
  • I agree with @SteffenUllrich. Only you know how these apps are built, and only you know what libraries you are using for the API requests and whether or not CORS is a concern. In general I wouldn't expect the client library in such cases to pay attention to CORS in the slightest, but if you are using the wrong client library it may very well be relying on a browser in the background and therefore may care. – Conor Mancone Nov 18 '19 at 14:10
  • To pick a ridiculous example, I was working on an integration with an ERP program installed on a windows machine, and we had some wonky problems which we eventually realized were caused because this installed application was using an Internet Explorer SDK to make their API calls, effectively routing everything through the browser (which was a terrible idea, but we still had to deal with it). – Conor Mancone Nov 18 '19 at 14:11
  • 2
    So I think the better question is: if this is only used by a mobile client that doesn't care about CORS, then why in the world do you have CORS configured in such a permissive way? If the only people using the API don't care about CORS, then there is absolutely no reason to configure CORS like this. In other words, instead of asking "Does it hurt to do this?" you should ask, "Do I have any reason to do this in the first place?". If not, then ditch it. – Conor Mancone Nov 18 '19 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.