0

I'm testing a web application and burp detected this issue: Cross-origin resource sharing: arbitrary origin trusted

Looking at the response, I only see this header: Access-Control-Allow-Origin: https://www.evil.com

Considering the lack of this header set to true in the response: *Access-Control-Allow-Credentials: true * can I consider this vulnerability a false positive?

Thanks a lot!

moskino11
  • 117
  • 6
  • Related: https://security.stackexchange.com/questions/227779/concrete-example-of-how-can-access-control-allow-origin-cause-security-risks – jub0bs Sep 18 '21 at 09:14
  • 5
    Does this answer your question? [Concrete example of how can Access-Control-Allow-Origin:\* cause security risks?](https://security.stackexchange.com/questions/227779/concrete-example-of-how-can-access-control-allow-origin-cause-security-risks) – jub0bs Sep 18 '21 at 09:15

1 Answers1

1

Burp is Very Concerned about CORS for some reason. Non-credentialed CORS requests can be a vulnerability, but only if the server (or endpoint) authorization is based on something other than credentials/authentication, and specifically is based on request source. For everything else, it's a non-issue; any attacker could just directly make the request themselves. Burp will consider it to always be a high-confidence high-severity vuln, though.

In other words, if an endpoint is only available via local or loopback connections, or only available to specific IPs, then un-authenticated CORS might be a risk. In all other cases - which cover the vast majority of situations - it's not. In theory, Burp could test this directly by checking the endpoint from a collaborator server or similar (and compare that to what it gets from the proxy), but this doesn't seem to be a feature it has.

With that said, if you're going to allow arbitrary origins, and are not going to allow credentials, that's exactly the use for Access-Control-Allow-Origin: *. Just be warned that Burp will freak out about that too.

CBHacking
  • 40,303
  • 3
  • 74
  • 98
  • Thanks for your support ! – moskino11 Sep 17 '21 at 12:14
  • As mentioned [elsewhere](https://security.stackexchange.com/a/254684/127436), allowing arbitrary origins on endpoints that may return *private* data and are not protected against CSRF (e.g. login, in many cases) is dangerous. – jub0bs Dec 19 '21 at 17:03