CorsMisconfiguration.qhelp

<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>

<overview>
	<p>

		A server can send the
		<code>"Access-Control-Allow-Credentials"</code> CORS header to control
		when a browser may send user credentials in Cross-Origin HTTP
		requests.

	</p>
	<p>

		When the <code>Access-Control-Allow-Credentials</code> header
		is <code>"true"</code>, the <code>Access-Control-Allow-Origin</code>
		header must have a value different from <code>"*"</code> in order to
		make browsers accept the header. Therefore, to allow multiple origins
		for Cross-Origin requests with credentials, the server must
		dynamically compute the value of the
		<code>"Access-Control-Allow-Origin"</code> header. Computing this
		header value from information in the request to the server can
		therefore potentially allow an attacker to control the origins that
		the browser sends credentials to.

	</p>



</overview>

<recommendation>
	<p>

		When the <code>Access-Control-Allow-Credentials</code> header
		value is <code>"true"</code>, a dynamic computation of the
		<code>Access-Control-Allow-Origin</code> header must involve
		sanitization if it relies on user-controlled input.


	</p>
	<p>

		Since the <code>"null"</code> origin is easy to obtain for an
		attacker, it is never safe to use <code>"null"</code> as the value of
		the <code>Access-Control-Allow-Origin</code> header when the
		<code>Access-Control-Allow-Credentials</code> header value is
		<code>"true"</code>.

	</p>
</recommendation>

<example>
	<p>

		In the example below, the server allows the browser to send
		user credentials in a Cross-Origin request. The request header
		<code>origins</code> controls the allowed origins for such a
		Cross-Origin request.

	</p>

	<sample src="examples/CorsBad.cs"/>

	<p>

		This is not secure, since an attacker can choose the value of
		the <code>origin</code> request header to make the browser send
		credentials to their own server. The use of a allowlist containing
		allowed origins for the Cross-Origin request fixes the issue:

	</p>

	<sample src="examples/CorsGood.cs"/>
</example>

<references>
	<li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin">CORS, Access-Control-Allow-Origin</a>.</li>
	<li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials">CORS, Access-Control-Allow-Credentials</a>.</li>
	<li>PortSwigger: <a href="http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html">Exploiting CORS Misconfigurations for Bitcoins and Bounties</a></li>
	<li>W3C: <a href="https://w3c.github.io/webappsec-cors-for-developers/#resources">CORS for developers, Advice for Resource Owners</a></li>
</references>
</qhelp>