CORS misconfig + HTTP subdomain XSS analysis showing API key exfiltration, exploit breakdown and remediation.
Lab: CORS vulnerability with trusted insecure protocols
Lab link: https://portswigger.net/web-security/cors/lab-breaking-https-attack
Author: Aditya Bhatt — Cybersecurity / VAPT Practitioner
Free Article Link
TL;DR
I combined a permissive CORS configuration (which reflects arbitrary subdomain origins, including HTTP) with a reflected XSS vector in the product lookup to exfiltrate an administrator API key. The exploit uses the stock HTTP subdomain to run attacker-controlled script, performs a credentialed XHR to /accountDetails, and forwards the JSON to an exploit server. Lab solved. 🥳🔑
Press enter or click to view image in full size
Overview
CORS is a powerful browser mechanism that, when misconfigured, can be disastrous. In this lab I found a server that:
- Reflected arbitrary subdomain Origins in
Access-Control-Allow-Origin(includinghttp://subdomain Origins), and - Returned
Access-Control-Allow-Credentials: true, and