CORS issue with response headers from trusted origin

  • marksweb

    (@marksweb)


    7 years, 3 months ago

    I’ve just had a vulnerability raised against a WP system I’ve got which shows a request which the system thinks is coming from bing.com being treated as a trusted origin & getting various headers applied.

    Example Request:

    GET /wp-json HTTP/1.1
Origin: http://www.bing.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate

    Response:

    HTTP/1.1 200 OK
Server: nginx
Date: Fri, 29 Mar 2019 09:54:17 GMT
Content-Type: application/json; charset=UTF-8
Connection: close
X-Content-Type-Options: nosniff
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages
Access-Control-Allow-Headers: Authorization, Content-Type
Allow: GET
Access-Control-Allow-Origin: http://www.bing.com
Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Credentials: true

    I’m not really sure where the system is defining bing.com as an origin to add these headers to the responses, but I’d love to know how to stop it.

    Can anyone reproduce this issue or offer a suggestion for a correction?

Viewing 2 replies - 1 through 2 (of 2 total)
  • Moderator bcworkz

    (@bcworkz)

    7 years, 3 months ago

    While it happens to be a WP API request, nothing else has anything to do with WP AFAIK. It’s all server defined responses related to what is allowed in a CORS exchange. What you posted is the “preflight” exchange. The actual serving of content is in a subsequent request.

    I’m not sure how easy it would be for an attacker to spoof the client data, but taken as an honest exchange, someone using a FF browser has loaded a page with script running that came from bing dot com. That script is requesting the WP schema of the REST API. Your server responded with what the bing dot com script is allowed to do.

    Your server is not defining bing dot com as an origin, the client browser is telling us the script requesting your API schema came from bing dot com. The server is required to respond to CORS requests in a certain way. You shouldn’t try to stop this. If you wish to prevent bing dot com scripts from accessing your server, then a different response should be sent, but simply not sending the required CORS response headers would make your server non-compliant.

    Seeing that Bing is a significant search engine, unless you are trying to hide your site or if Bing is being abusive, I don’t think blocking Bing would be a good idea.

    Thread Starter marksweb

    (@marksweb)

    7 years, 3 months ago

    @bcworkz thank you, superb explanation. I haven’t done anything in PHP for years & just leave my WP site sat around so wanted to query this incase there was something to consider here. I also wasn’t sure on the implication of these headers being added to the response & what they might enable someone to do.

    This issue has been posted as a flaw in security on Open Bug Bounty so wanted to clarify with people who know WordPress better than I do!

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘CORS issue with response headers from trusted origin’ is closed to new replies.