API8:2023 — Security Misconfiguration

Slide 10 · Pattern 1 Mechanics

Reflected CORS + Credentials → Cross-Origin Account Access

Step by step: how a CORS misconfiguration becomes authenticated account data theft.

THE SETUP

An API that reflects the Origin header with credentials allowed.

The API response includes:

Access-Control-Allow-Origin: [whatever the caller sent as Origin]

Access-Control-Allow-Credentials: true

The API uses session cookies for authentication. Users are logged in when they visit the app.

1️⃣

Attacker hosts a page at https://evil.attacker.com

The page contains JavaScript:

fetch(’https://api.target.com/api/account’, { credentials: ’include’ }).then(r => r.json()).then(data => { /* send data to attacker */ });

2️⃣

Victim visits evil.attacker.com while logged into target.com

The JavaScript runs. The browser sends a cross-origin request to api.target.com with the victim’s session cookie (because credentials: include).

3️⃣

The API checks its CORS configuration

The incoming Origin: https://evil.attacker.com. The API reflects it: Access-Control-Allow-Origin: https://evil.attacker.com + Access-Control-Allow-Credentials: true.

4️⃣

The browser allows the page to read the API response

Because the CORS headers say the origin is permitted and credentials are allowed, the browser lets the JavaScript read the response body — which contains the victim’s account data. The JavaScript sends it to the attacker.

← Back Tesla deep dive →