Bug: Cross-origin resource sharing: arbitrary origin trusted
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2021-04-08 07:42:01+00:00
Resolved: 2024-06-07 16:23:32+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Firefox for Android

Steps to reproduce:

The application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain.  The application allowed access from the requested origin null  The application allows two-way interaction from the null origin. This effectively means that any domain can perform two-way interaction by causing the browser to submit the null origin, for example by issuing the request from a sandboxed iframe. 

POST /1.5/182018755/storage/clients?batch=true&commit=true HTTP/1.1
Host: sync-1-us-west1-g.sync.services.mozilla.com
User-Agent: Firefox/87.0 (Windows NT 10.0; Win64; x64) FxSync/1.89.0.20210318103112.desktop
Accept: application/json;q=0.9,*/*;q=0.2
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
authorization: Hawk id="eyJ1aWQiOiAxODIwMTg3NTUsICJub2RlIjogImh0dHBzOi8vc3luYy0xLXVzLXdlc3QxLWcuc3luYy5zZXJ2aWNlcy5tb3ppbGxhLmNvbSIsICJleHBpcmVzIjogMTYxNzg2MzI2MywgImZ4YV91aWQiOiAiNTM1ZjYzNTliNmI1NDNjYjk5MTIzNjk5ZjA5ODNmN2IiLCAiZnhhX2tpZCI6ICIxNjE0MTM5ODA0MjE2LVgyWWp2YVNOX1pJQVlaMVozeVJfaHciLCAiaGFzaGVkX2Z4YV91aWQiOiAiYzE3NzhmZmU3Mjg2MmVkODYwODk5MTIwMmI0NzY3N2IiLCAiaGFzaGVkX2RldmljZV9pZCI6ICI1YzhmNGYzMzViYjU0NjkzOTJlMzMyMmZjMDQ1MzFhMSIsICJzYWx0IjogIjIwOWY3MiJ9mmocyMgTYhiXhn_chjdGpoo2Kr34ediGrEwc7UU3v7g=", ts="1617859668", nonce="6ZESbcDGBj8=", mac="gJbBdaIrgsxWvIX80xVKq4BqqlPv4DhPkipr0LPBzi4="
content-type: text/plain
x-if-unmodified-since: 1617780871.28
Origin: null
Content-Length: 549
Connection: close
Pragma: no-cache
Cache-Control: no-cache

[{"payload":"{\"ciphertext\":\"0kg/RY1s0Mpgp4Gfax5L29I2uHbnxqKkwmVUc8eicXcecezYXeDqpwZ+823OcxJ/37nFw1K4K/jhTYZHqZLN9Xa6TFM2nZJ4E1AoXJmrExYhWDlB1D33LnXIuMlRJ7mpXj+WLtaL9xSBa2cKemK/BRYOqNuSu8shGkvLpAxJCcO3syXE34j4SdeNjZ+/VCcj9xVF269pK5GH99nDpG8NG9YKf2fPKP6RD5DXAAcPFUgld/IJEgIMJJognwlZXWWUmoes1MZP2ZQqssVx7cssdY2cbdE4eQUUHxit6JvSMiwGTqAcxp+s2Jbwz5KXBExHJLl6ZQN3+IJEbRqDqwBjqMC9fWrNc9Ib2MUq+BPaFlY=\",\"IV\":\"fEYadYyvRnMza39JcthYzg==\",\"hmac\":\"b590ab73b88953a86eaac0f3c98fd8e6216b701baf7e4a7eda20344a7ba69d17\"}","id":"1F9OowLlYwxU","ttl":1814400}]

remediation
Rather than using a wildcard or programmatically verifying supplied origins, use a whitelist of trusted domains.

References
https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties

Impact
Since the Vary: Origin header was not present in the response, reverse proxies and intermediate servers may cache it. This may enable an attacker to carry out cache poisoning attacks.
An HTML5 cross-origin resource sharing (CORS) policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of the request.
Trusting arbitrary origins effectively disables the same-origin policy, allowing two-way interaction by third-party web sites. Unless the response consists only of unprotected public content, this policy is likely to present a security risk.
If the site specifies the header Access-Control-Allow-Credentials: true, third-party sites may be able to carry out privileged actions and retrieve sensitive information. Even if it does not, attackers may be able to bypass any IP-based access controls by proxying through users' browsers





Actual results:

HTTP/1.1 200 OK
Server: openresty/1.15.8.2
Date: Thu, 08 Apr 2021 05:27:49 GMT
Content-Type: application/json
Content-Length: 65
vary: Origin
access-control-allow-origin: null
access-control-allow-credentials: true
x-last-modified: 1617859668.98
x-weave-timestamp: 1617859668.98
Access-Control-Allow-Origin: null
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: DELETE, GET, POST, PUT, OPTIONS
Access-Control-Max-Age: 1728000
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-Conditions-Accepted
Via: 1.1 google
Alt-Svc: clear
Connection: close

{"modified":1617859668.98,"success":["1F9OowLlYwxU"],"failed":{}}