You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CORS Misconfiguration/README.md
+19-28
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,6 @@
1
1
# CORS Misconfiguration
2
2
3
-
> A site-wide CORS misconfiguration was in place for an API domain. This allowed an attacker to make cross origin requests on behalf of the user as the application did not whitelist the Origin header and had Access-Control-Allow-Credentials: true meaning we could make requests from our attacker’s site using the victim’s credentials.
4
-
3
+
> A site-wide CORS misconfiguration was in place for an API domain. This allowed an attacker to make cross origin requests on behalf of the user as the application did not whitelist the Origin header and had Access-Control-Allow-Credentials: true meaning we could make requests from our attacker’s site using the victim’s credentials.
5
4
6
5
## Summary
7
6
@@ -16,7 +15,6 @@
16
15
*[Labs](#labs)
17
16
*[References](#references)
18
17
19
-
20
18
## Tools
21
19
22
20
*[s0md3v/Corsy](https://github.com/s0md3v/Corsy/) - CORS Misconfiguration Scanner
@@ -25,14 +23,12 @@
25
23
*[trufflesecurity/of-cors](https://github.com/trufflesecurity/of-cors) - Exploit CORS misconfigurations on the internal networks
26
24
*[omranisecurity/CorsOne](https://github.com/omranisecurity/CorsOne) - Fast CORS Misconfiguration Discovery Tool
* VICTIM HEADER> `Access-Control-Allow-Origin: https://evil.com` OR `Access-Control-Allow-Origin: null`
34
31
35
-
36
32
## Methodology
37
33
38
34
Usually you want to target an API endpoint. Use the following payload to exploit a CORS misconfiguration on target `https://victim.example.com/endpoint`.
@@ -70,7 +66,7 @@ function reqListener() {
70
66
};
71
67
```
72
68
73
-
or
69
+
or
74
70
75
71
```html
76
72
<html>
@@ -105,7 +101,7 @@ It's possible that the server does not reflect the complete `Origin` header but
105
101
that the `null` origin is allowed. This would look like this in the server's
106
102
response:
107
103
108
-
```
104
+
```ps1
109
105
GET /endpoint HTTP/1.1
110
106
Host: victim.example.com
111
107
Origin: null
@@ -145,7 +141,7 @@ exploit codes from above do not work. But if you have an XSS on a trusted
145
141
origin, you can inject the exploit coded from above in order to exploit CORS
If the server responds with a wildcard origin `*`, **the browser does never send
155
151
the cookies**. However, if the server does not require authentication, it's still
156
152
possible to access the data on the server. This can happen on internal servers
157
-
that are not accessible from the Internet. The attacker's website can then
153
+
that are not accessible from the Internet. The attacker's website can then
158
154
pivot into the internal network and access the server's data without authentication.
159
155
160
156
```powershell
@@ -188,16 +184,15 @@ function reqListener() {
188
184
};
189
185
```
190
186
191
-
192
187
### Expanding the Origin
193
188
194
189
Occasionally, certain expansions of the original origin are not filtered on the server side. This might be caused by using a badly implemented regular expressions to validate the origin header.
195
190
196
191
#### Vulnerable Implementation (Example 1)
197
192
198
-
In this scenario any prefix inserted in front of `example.com` will be accepted by the server.
193
+
In this scenario any prefix inserted in front of `example.com` will be accepted by the server.
In this scenario the server utilizes a regex where the dot was not escaped correctly. For instance, something like this: `^api.example.com$` instead of `^api\.example.com$`. Thus, the dot can be replaced with any letter to gain access from a third-party domain.
-[Advanced CORS Exploitation Techniques - Corben Leo - June 16, 2018](https://web.archive.org/web/20190516052453/https://www.corben.io/advanced-cors-techniques/)
-[CORS Misconfiguration leading to Private Information Disclosure - sandh0t (sandh0t) - October 29, 2018](https://hackerone.com/reports/430249)
277
-
-[CORS Misconfiguration on www.zomato.com - James Kettle (albinowax) - September 15, 2016](https://hackerone.com/reports/168574)
278
-
-[CORS Misconfigurations Explained - Detectify Blog - April 26, 2018](https://blog.detectify.com/2018/04/26/cors-misconfigurations-explained/)
279
-
-[Cross-origin resource sharing (CORS) - PortSwigger Web Security Academy - December 30, 2019](https://portswigger.net/web-security/cors)
280
-
-[Cross-origin resource sharing misconfig | steal user information - bughunterboy (bughunterboy) - June 1, 2017](https://hackerone.com/reports/235200)
281
-
-[Exploiting CORS misconfigurations for Bitcoins and bounties - James Kettle - 14 October 2016](https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties)
282
-
-[Exploiting Misconfigured CORS (Cross Origin Resource Sharing) - Geekboy - December 16, 2016](https://www.geekboy.ninja/blog/exploiting-misconfigured-cors-cross-origin-resource-sharing/)
283
-
-[Think Outside the Scope: Advanced CORS Exploitation Techniques - Ayoub Safa (Sandh0t) - May 14 2019](https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397)
*[Advanced CORS Exploitation Techniques - Corben Leo - June 16, 2018](https://web.archive.org/web/20190516052453/https://www.corben.io/advanced-cors-techniques/)
*[CORS Misconfiguration leading to Private Information Disclosure - sandh0t (sandh0t) - October 29, 2018](https://hackerone.com/reports/430249)
268
+
*[CORS Misconfiguration on www.zomato.com - James Kettle (albinowax) - September 15, 2016](https://hackerone.com/reports/168574)
269
+
*[CORS Misconfigurations Explained - Detectify Blog - April 26, 2018](https://blog.detectify.com/2018/04/26/cors-misconfigurations-explained/)
270
+
*[Cross-origin resource sharing (CORS) - PortSwigger Web Security Academy - December 30, 2019](https://portswigger.net/web-security/cors)
271
+
*[Cross-origin resource sharing misconfig | steal user information - bughunterboy (bughunterboy) - June 1, 2017](https://hackerone.com/reports/235200)
272
+
*[Exploiting CORS misconfigurations for Bitcoins and bounties - James Kettle - 14 October 2016](https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties)
273
+
*[Exploiting Misconfigured CORS (Cross Origin Resource Sharing) - Geekboy - December 16, 2016](https://www.geekboy.ninja/blog/exploiting-misconfigured-cors-cross-origin-resource-sharing/)
274
+
*[Think Outside the Scope: Advanced CORS Exploitation Techniques - Ayoub Safa (Sandh0t) - May 14 2019](https://medium.com/bugbountywriteup/think-outside-the-scope-advanced-cors-exploitation-techniques-dad019c68397)
Copy file name to clipboardExpand all lines: CRLF Injection/README.md
+9-16
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,6 @@
12
12
*[Labs](#labs)
13
13
*[References](#references)
14
14
15
-
16
15
## Methodology
17
16
18
17
HTTP Response Splitting is a security vulnerability where an attacker manipulates an HTTP response by injecting Carriage Return (CR) and Line Feed (LF) characters (collectively called CRLF) into a response header. These characters mark the end of a header and the start of a new line in HTTP responses.
@@ -28,7 +27,6 @@ By injecting a CRLF sequence, the attacker can break the response into two parts
28
27
* Cache Poisoning: Forcing incorrect content to be stored in caches.
29
28
* Header Manipulation: Altering headers to mislead users or systems
30
29
31
-
32
30
### Session Fixation
33
31
34
32
A typical HTTP response header looks like this:
@@ -50,18 +48,17 @@ Set-Cookie: admin=true
50
48
51
49
Now the attacker has set their own cookie.
52
50
53
-
54
51
### Cross Site Scripting
55
52
56
53
Beside the session fixation that requires a very insecure way of handling user session, the easiest way to exploit a CRLF injection is to write a new body for the page. It can be used to create a phishing page or to trigger an arbitrary Javascript code (XSS).
In the case of an XSS, the CRLF injection allows to inject the `X-XSS-Protection` header with the value value "0", to disable it. And then we can add our HTML tag containing Javascript code .
@@ -114,10 +111,9 @@ Inject a `Location` header to force a redirect for the user.
114
111
%0d%0aLocation:%20http://myweb.com
115
112
```
116
113
117
-
118
114
## Filter Bypass
119
115
120
-
[RFC 7230](https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.4) states that most HTTP header field values use only a subset of the US-ASCII charset.
116
+
[RFC 7230](https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.4) states that most HTTP header field values use only a subset of the US-ASCII charset.
121
117
122
118
> Newly defined header fields SHOULD limit their field values to US-ASCII octets.
123
119
@@ -132,7 +128,6 @@ Firefox followed the spec by stripping off any out-of-range characters when sett
132
128
133
129
The UTF-8 character `嘊` contains `0a` in the last part of its hex format, which would be converted as `\n` by Firefox.
134
130
135
-
136
131
An example payload using UTF-8 characters would be:
> Client-Side Path Traversal (CSPT), sometimes also referred to as "On-site Request Forgery," is a vulnerability that can be exploited as a tool for CSRF or XSS attacks.
4
-
5
4
> It takes advantage of the client side's ability to make requests using fetch to a URL, where multiple "../" characters can be injected. After normalization, these characters redirect the request to a different URL, potentially leading to security breaches.
6
-
7
5
> Since every request is initiated from within the frontend of the application, the browser automatically includes cookies and other authentication mechanisms, making them available for exploitation in these attacks.
8
6
9
-
10
7
## Summary
11
8
12
9
*[Tools](#tools)
@@ -16,17 +13,15 @@
16
13
*[Labs](#labs)
17
14
*[References](#references)
18
15
19
-
20
16
## Tools
21
17
22
18
*[doyensec/CSPTBurpExtension](https://github.com/doyensec/CSPTBurpExtension) - CSPT is an open-source Burp Suite extension to find and exploit Client-Side Path Traversal.
A post-serving page calls the fetch function, sending a request to a URL with attacker-controlled input which is not properly encoded in its path, allowing the attacker to inject `../` sequences to the path and make the request get sent to an arbitrary endpoint. This behavior is referred to as a CSPT vulnerability.
32
27
@@ -37,7 +32,6 @@ A post-serving page calls the fetch function, sending a request to a URL with at
37
32
* A text injection was also discovered in `https://example.com/pricing/default.js` via the `cb` parameter
38
33
* Final payload is `https://example.com/static/cms/news.html?newsitemid=../pricing/default.js?cb=alert(document.domain)//`
39
34
40
-
41
35
### CSPT to CSRF
42
36
43
37
A CSPT is redirecting legitimate HTTP requests, allowing the front end to add necessary tokens for API calls, such as authentication or CSRF tokens. This capability can potentially be exploited to circumvent existing CSRF protection measures.
@@ -52,30 +46,27 @@ A CSPT is redirecting legitimate HTTP requests, allowing the front end to add ne
52
46
| 1-click CSRF ? |:x:|:white_check_mark:|
53
47
| Does impact depend on source and on sinks ? |:x:|:white_check_mark:|
54
48
55
-
56
49
Real-World Scenarios:
57
50
58
51
* 1-click CSPT2CSRF in Rocket.Chat
59
52
*CVE-2023-45316: CSPT2CSRF with a POST sink in Mattermost : `/<team>/channels/channelname?telem_action=under_control&forceRHSOpen&telem_run_id=../../../../../../api/v4/caches/invalidate`
60
53
*CVE-2023-6458: CSPT2CSRF with a GET sink in Mattermost
61
54
*[Client Side Path Manipulation - erasec.be](https://www.erasec.be/blog/client-side-path-manipulation/): CSPT2CSRF `https://example.com/signup/invite?email=foo%40bar.com&inviteCode=123456789/../../../cards/123e4567-e89b-42d3-a456-556642440000/cancel?a=`
62
-
*[CVE-2023-5123 : CSPT2CSRF in Grafana’s JSON API Plugin](https://medium.com/@maxime.escourbiac/grafana-cve-2023-5123-write-up-74e1be7ef652)
63
-
55
+
*[CVE-2023-5123 : CSPT2CSRF in Grafana’s JSON API Plugin](https://medium.com/@maxime.escourbiac/grafana-cve-2023-5123-write-up-74e1be7ef652)
64
56
65
57
## Labs
66
58
67
59
*[doyensec/CSPTPlayground](https://github.com/doyensec/CSPTPlayground) - CSPTPlayground is an open-source playground to find and exploit Client-Side Path Traversal (CSPT).
68
60
*[Root Me - CSPT - The Ruler](https://www.root-me.org/en/Challenges/Web-Client/CSPT-The-Ruler)
-[Exploiting Client-Side Path Traversal - CSRF is dead, long live CSRF - Whitepaper - Maxence Schmitt - 02 Jul 2024](https://www.doyensec.com/resources/Doyensec_CSPT2CSRF_Whitepaper.pdf)
75
-
-[Exploiting Client-Side Path Traversal - CSRF is Dead, Long Live CSRF - OWASP Global AppSec 2024 - Maxence Schmitt - June 24 2024](https://www.doyensec.com/resources/Doyensec_CSPT2CSRF_OWASP_Appsec_Lisbon.pdf)
76
-
-[Leaking Jupyter instance auth token chaining CVE-2023-39968, CVE-2024-22421 and a chromium bug - Davwwwx - 30-08-2023](https://blog.xss.am/2023/08/cve-2023-39968-jupyter-token-leak/)
77
-
-[On-site request forgery - Dafydd Stuttard - 03 May 2007](https://portswigger.net/blog/on-site-request-forgery)
78
-
-[Bypassing WAFs to Exploit CSPT Using Encoding Levels - Matan Berson - 2024-05-10](https://matanber.com/blog/cspt-levels)
*[Exploiting Client-Side Path Traversal - CSRF is dead, long live CSRF - Whitepaper - Maxence Schmitt - 02 Jul 2024](https://www.doyensec.com/resources/Doyensec_CSPT2CSRF_Whitepaper.pdf)
66
+
*[Exploiting Client-Side Path Traversal - CSRF is Dead, Long Live CSRF - OWASP Global AppSec 2024 - Maxence Schmitt - June 24 2024](https://www.doyensec.com/resources/Doyensec_CSPT2CSRF_OWASP_Appsec_Lisbon.pdf)
67
+
*[Leaking Jupyter instance auth token chaining CVE-2023-39968, CVE-2024-22421 and a chromium bug - Davwwwx - 30-08-2023](https://blog.xss.am/2023/08/cve-2023-39968-jupyter-token-leak/)
68
+
*[On-site request forgery - Dafydd Stuttard - 03 May 2007](https://portswigger.net/blog/on-site-request-forgery)
69
+
*[Bypassing WAFs to Exploit CSPT Using Encoding Levels - Matan Berson - 2024-05-10](https://matanber.com/blog/cspt-levels)
0 commit comments