EXPLOITING TRUST: WEAPONIZING PERMISSIVE CORS CONFIGURATIONS

Summary from the TLDR InfoSec newsletter

Websites can employ CORS to allow for sharing of data to a different website, bypassing same-origin restrictions. This blog post presents a collection of case studies that showcase CORS misconfigurations that can be exploited such as arbitrary reflected origin, only checking the beginning of the Origin header, trusting related subdomains or localhost, and other more complicated techniques. Advice to pentesters hunting for CORS vulnerabilities includes making sure to scan all endpoints, considering related domains, applying context to findings, and testing for subdomain reflection.