Later archive addition

Exploiting CORS Misconfigurations for Bitcoins and Bounties

James Kettle · PortSwigger Research · 14 October 2016

Servers that reflect the Origin header into Access-Control-Allow-Origin while sending Allow-Credentials true let any website read a victim's authenticated cross-domain responses. The post covers sloppy origin matching, whitelisting the null origin that any sandboxed iframe can produce, and a missing Vary: Origin enabling client-side and server-side cache poisoning; the targets were bitcoin exchanges.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

14 October 2016

In the archive

• Added to the 2016–17 archive after the original list was published

Related sources

• AppSec USA slides
• Talk recording
• Talk recording
• Talk recording

Tags

• cors
• sop-bypass
• cache-poisoning
• same-origin-policy
• header-injection
• info-leak
• filter-bypass
• bug-bounty
• http
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host.