I was completing an assessment for a client and discovered that web application implemented a Permissive CORS policy which allowed for a Arbitrary Origin Trust.


User-agent: blah
Accept: */*
Accept Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: https://arbitrary-domain.com
Connection: close
Content-Length:  16

Server Response:

Content-Type: application/json; charset=utf-8
Vary: Origin
Server: [REDACTED]
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://arbitrary-domain.com
X-Powered-By: [REDACTED]
Connection Close
Content-Length: 6295

{JSON Content}

It was also discovered that the CORS Policy was configured using wildcards such as (*), meaning that any domain can access resources on this site. Shortly after this, I was able to exploit the issue and compromise sensitive information.

Researching fixes for this issue aren't very clear, or that I simply don't understand the remedial action suggested. I also see a lot of remedial action aimed at CSRF but not for CORS, so I am a little stuck on this. Exploiting this vulnerability appears to be a lot easier than fixing it.

My question is, what would the suggested remedial action be for this vulnerability? Is there a configuration that can be applied to IIS? What would one do to remediate this issue? As this vulnerability is pretty serious.

Any advice would be highly appreciated, thanks!

EDIT: I understand there is a whitelist approach to fix this issue but the ambiguity comes in where this whitelist is configured. Is there a configuration file that needs to configured on the host?

  • Try to whitelist your Access-Control-Allow-Origin :moesif.com/blog/technical/cors/… Nov 30, 2020 at 8:53
  • Thanks for your response Soufiane! I have read up quite extensively with regards to the whitelisting approach but I don't find a clear answer where the white list is configured, is there a configuration file within IIS or is there something else that needs to be configured.
    – SecGuy45
    Nov 30, 2020 at 10:40
  • I believe it's a project-specific configuration. I think this will help you stackoverflow.com/questions/12458444/… Nov 30, 2020 at 14:09
  • 1
    Thank you very much Soufiane, the link did help. Plus with a little bit of research I was able to find the fix and apply it accordingly.
    – SecGuy45
    Dec 1, 2020 at 11:47

1 Answer 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .