By default, browsers enforce the Same-Origin Policy (SOP) and restrict how one service can interact with another. From the perspective of the
browser, a service is defined by its "origin", a tuple (scheme, domain, port).
Effectively, it blocks attempts to retrieve the data
of a Server A from a Server B if its origin is not the exact same tuple.
Cross-Origin Resource Sharing (CORS) is a mechanism that Server A can use to relax the SOP and allow Server B of a
different origin, to access data of Server A.
This trust is set setup via the Access-Control-Allow-Origin header, and
can be configured alongside other headers, such as:
- Access-Control-Allow-Methods
- Access-Control-Allow-Headers
- Access-Control-Allow-Credentials
- Access-Control-Max-Age
What is the potential impact?
CORS injection occurs when an application unsafely retrieves data from an incoming request and reflects it into the Cross-Origin Resource Sharing
(CORS) headers of the response without sanitization.
Enabling third-party manipulation of the Access-Control-Allow-Origin header exposes the application to a varity of different attacks,
namely XSS or TLS hijacking.
The situation is worsened if the Access-Control-Allow-Credentials is set to true or
injectable.
