API8:2023 — Security Misconfiguration

Slide 9 · Two Attack Patterns

Two patterns. Different surfaces. Both exploitable without any application code bug.

CORS credential theft and admin endpoint takeover — the two highest-impact misconfiguration paths.

Pattern 1: CORS Credential Theft

Target: an API with permissive CORS (reflects any origin + credentials)

Attacker hosts a malicious page at their domain

Victim visits the page while logged into the target API

Page makes cross-origin API calls with victim’s session cookies

Attacker reads the full API response — victim’s account data, PII, tokens

No credentials needed. No code vulnerability exploited.

Pattern 2: Admin Endpoint Takeover

Target: an admin, debug, or management endpoint with no auth or default credentials

Attacker discovers the endpoint via scanning (common paths: /admin, /actuator, /console, /debug, /metrics)

Attacker accesses the endpoint directly — no login required

Endpoint exposes data, credentials, or allows system control

Attacker exfiltrates data, deploys malware, or uses credentials to pivot

What makes both patterns dangerous

Neither attack exploits a bug in the application’s business logic. Both exploit the absence of a control that should have been present. In Pattern 1, the application logic is correct — it just has the wrong CORS policy. In Pattern 2, the endpoint works as designed — it just shouldn’t be reachable without authentication. The fix in each case is a configuration change, not a code change.

← Back CORS theft mechanics →