¡El futuro de Confianza Cero y SASE es ahora! Ver a la carta

cerrar
cerrar
  • Por qué Netskope chevron

    Cambiar la forma en que las redes y la seguridad trabajan juntas.

  • Nuestros clientes chevron

    Netskope atiende a más de 3.000 clientes en todo el mundo, entre ellos más de 25 de las 100 empresas de Fortune

  • Nuestros Partners chevron

    Nos asociamos con líderes en seguridad para ayudarlo a asegurar su viaje a la nube.

La más Alta en Ejecución. Más Avanzada en Visión.

Netskope ha sido reconocido como Líder en el Gartner® Magic Quadrant™ de 2023 en SSE.

Obtenga el informe
Netskope ha sido reconocido como Líder en el Gartner® Magic Quadrant™ de 2023 en SSE.
Ayudamos a nuestros clientes a estar preparados para cualquier situación

Ver nuestros clientes
Woman smiling with glasses looking out window
La estrategia de venta centrada en el partner de Netskope permite a nuestros canales maximizar su expansión y rentabilidad y, al mismo tiempo, transformar la seguridad de su empresa.

Más información sobre los socios de Netskope
Group of diverse young professionals smiling
Tu red del mañana

Planifique su camino hacia una red más rápida, más segura y más resistente diseñada para las aplicaciones y los usuarios a los que da soporte.

Obtenga el whitepaper
Tu red del mañana
Presentamos la Netskope One Plataforma

Netskope One es una Plataforma nativa en la nube que ofrece servicios convergentes de seguridad y redes para hacer posible su transformación SASE y de confianza cero.

Learn about Netskope One
Abstracto con iluminación azul
Adopte una arquitectura de borde de servicio de acceso seguro (SASE)

Netskope NewEdge es la nube privada de seguridad más grande y de mayor rendimiento del mundo y ofrece a los clientes una cobertura de servicio, un rendimiento y una resiliencia incomparables.

Más información sobre NewEdge
NewEdge
Netskope Cloud Exchange

Cloud Exchange (CE) de Netskope ofrece a sus clientes herramientas de integración eficaces para que saquen partido a su inversión en estrategias de seguridad.

Más información sobre Cloud Exchange
Vídeo de Netskope
  • Servicio de seguridad Productos Edge chevron

    Protéjase contra las amenazas avanzadas y en la nube y salvaguarde los datos en todos los vectores.

  • Borderless SD-WAN chevron

    Proporcione con confianza un acceso seguro y de alto rendimiento a cada usuario remoto, dispositivo, sitio y nube.

  • Secure Access Service Edge chevron

    Netskope One SASE proporciona una solución SASE nativa en la nube, totalmente convergente y de un único proveedor.

La plataforma del futuro es Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) y Private Access for ZTNA integrados de forma nativa en una única solución para ayudar a todas las empresas en su camino hacia el Servicio de acceso seguro Arquitectura perimetral (SASE).

Todos los productos
Vídeo de Netskope
Next Gen SASE Branch es híbrida: conectada, segura y automatizada

Netskope Next Gen SASE Branch converge Context-Aware SASE Fabric, Zero-Trust Hybrid Security y SkopeAI-Powered Cloud Orchestrator en una oferta de nube unificada, marcando el comienzo de una experiencia de sucursal completamente modernizada para la empresa sin fronteras.

Obtenga más información sobre Next Gen SASE Branch
Personas en la oficina de espacios abiertos.
Diseño de una arquitectura SASE para Dummies

Obtenga un ejemplar gratuito del único manual que necesitará sobre diseño de una arquitectura SASE.

Obtenga el eBook
Cambie a los servicios de seguridad en la nube líderes del mercado con una latencia mínima y una alta fiabilidad.

Más información sobre NewEdge
Lighted highway through mountainside switchbacks
Habilite de forma segura el uso de aplicaciones de IA generativa con control de acceso a aplicaciones, capacitación de usuarios en tiempo real y la mejor protección de datos de su clase.

Descubra cómo aseguramos el uso generativo de IA
Habilite de forma segura ChatGPT y IA generativa
Soluciones de confianza cero para implementaciones de SSE y SASE

Más información sobre Confianza Cero
Boat driving through open sea
Netskope logra la alta autorización FedRAMP

Elija Netskope GovCloud para acelerar la transformación de su agencia.

Más información sobre Netskope GovCloud
Netskope GovCloud
  • Recursos chevron

    Obtenga más información sobre cómo Netskope puede ayudarle a proteger su viaje hacia la nube.

  • Blog chevron

    Descubra cómo Netskope permite la transformación de la seguridad y las redes a través del borde de servicio de seguridad (SSE)

  • Eventos y Talleres chevron

    Manténgase a la vanguardia de las últimas tendencias de seguridad y conéctese con sus pares.

  • Seguridad definida chevron

    Todo lo que necesitas saber en nuestra enciclopedia de ciberseguridad.

Podcast Security Visionaries

Zero Trust: es más que solo identidad
En este episodio, la presentadora Emily Wearmouth explora el concepto de confianza cero con los expertos en ciberseguridad John Kindervag, el "Padrino de la confianza cero", y Neil Thacker.

Reproducir el pódcast
Zero Trust: es más que solo identidad
Últimos blogs

Lea cómo Netskope puede hacer posible el viaje hacia la Confianza Cero y SASE a través de las capacidades del borde de servicio de seguridad (SSE).

Lea el blog
Sunrise and cloudy sky
SASE Week 2023: ¡Su viaje SASE comienza ahora!

Sesiones de repetición de la cuarta SASE Week.

Explorar sesiones
SASE Week 2023
¿Qué es Security Service Edge (SSE)?

Explore el lado de la seguridad de SASE, el futuro de la red y la protección en la nube.

Más información sobre el servicio de seguridad perimetral
Four-way roundabout
  • Empresa chevron

    Le ayudamos a mantenerse a la vanguardia de los desafíos de seguridad de la nube, los datos y la red.

  • Liderazgo chevron

    Nuestro equipo de liderazgo está firmemente comprometido a hacer todo lo necesario para que nuestros clientes tengan éxito.

  • Soluciones para clientes chevron

    Le apoyamos en cada paso del camino, garantizando su éxito con Netskope.

  • Formación y certificación chevron

    La formación de Netskope le ayudará a convertirse en un experto en seguridad en la nube.

Apoyar la sostenibilidad a través de la seguridad de los datos

Netskope se enorgullece de participar en Vision 2045: una iniciativa destinada a crear conciencia sobre el papel de la industria privada en la sostenibilidad.

Descubra más
Apoyando la sustentabilidad a través de la seguridad de los datos
Pensadores, constructores, soñadores, innovadores. Juntos, ofrecemos soluciones de seguridad en la nube de vanguardia para ayudar a nuestros clientes a proteger sus datos y usuarios.

Conozca a nuestro equipo
Group of hikers scaling a snowy mountain
El talentoso y experimentado equipo de servicios profesionales de Netskope proporciona un enfoque prescriptivo para su exitosa implementación.

Más información sobre servicios profesionales
Servicios profesionales de Netskope
Asegure su viaje de transformación digital y aproveche al máximo sus aplicaciones en la nube, web y privadas con la capacitación de Netskope.

Infórmese sobre Capacitaciones y Certificaciones
Group of young professionals working

CORS Exploitation in the Cloud

Jan 09 2020

Cross-Origin Resource Sharing (CORS) is a mechanism which uses HTTP headers to tell a browser that a web application running at one origin has permission to access selected resources from a server at a different origin. This functionality exists for cases where an application developer would want to deliberately ignore a same origin policy (SOP) which mitigates many common attacks against browsers (notably cross-site scripting). This makes it a powerful tool for applications deployed on our increasingly distributed Internet but also a potential source of vulnerability. 

Background: What is the Same-Origin Policy?

The Same-Origin Policy is a mitigating control which restricts how scripts or other resources from one origin interact with resources from a third party. 

Some examples of cross-origin requests are:

  • A different domain (example.com to test.com)
  • A different subdomain (example.com to test.example.com)
  • A different port (example.com to example.com:8080)
  • A different protocol (https://example.com to http://example.com)

The Same-Origin policy mitigates some common web application attacks and is a critical tool for protecting users and applications on the modern web.

More details are available at the Mozilla Developer Network.

How Does CORS Work?

There are two headers which primarily govern CORS: Access-Control-Allow-Origin, and Access-Control-Allow-Credentials. When a script from foo.com wants to make a request to bar.com, the browser sends a pre-flight request to bar.com with foo.com in the Origin header. This is how the browser asks for permission for the resource to interact with the requesting site. The service on bar.com will then return an Access-Control-Allow-Origin response header if the domain matches an allowed origin. Only if the domain matches the one hosting the script does the browser send the HTTP request.

The Access Control Allow Origin header accepts various origins:

  • Domains and subdomains (http://blah.example.com, https://example.com)
  • Wildcards (*)
  • ‘Null’

The case of the ‘Null’ origin is interesting and can result in some misconfigurations which we do not explore in this article. ‘Null’ is an origin assigned by default to many documents, sandboxed code, and redirects. While this is useful, it  can potentially open up your application to attack. The Mozilla Developer Network and w3c specify that the null origin should not be used. More details about that vulnerability are available in Portswigger’s blog on the subject.

Access-Control-Allow-Credentials is a boolean – that is, it can be only True or False. If our application requires a user to be authenticated to use it, and that application makes CORS requests on behalf of that logged in user, we require Access-Control-Allow-Credentials to be true. If the resources we are accessing do not absolutely require that the user’s credentials be passed to the cross-domain resource, we should set this to False. 

In some cases, you may want to bypass the same-origin policy to share content from a CDN, an S3 bucket, or an on-premises server.

  • If you host your website in S3, but want to use JavaScript to be able to make authenticated GET and PUT requests against the same bucket by using the Amazon S3 API endpoint for the bucket.
  • Loading a web font.
  • Loading dynamic content from another webpage.
  • Making an authenticated GET request to an on-prem server.

If you want to allow any domain to make a cross-origin request, you can certainly use the setting Access-Control-Allow-Origin: *

Unfortunately, per the CORS specification – if you have wildcards in your ACAO header, then Access-Control-Allow-Credentials cannot be true. While you might think that maintaining a list of allowed origins makes good sense, it turns out that CORS policy cannot accept a list either! So in order to allow credentials to be passed over a CORS request, you must process the origin and ensure that it’s valid. As we’ll explain, this is a recipe for disaster when developers are not careful.

CORS in the Cloud

In addition to the fact that any VM you deploy in your IaaS environment which supports HTTP can enable CORS, many individual services support CORS, including: 

  • Azure Functions
  • Azure Logic Apps
  • Azure Blob Storage
  • Google Cloud Functions
  • Google Cloud Storage
  • Google Cloud Endpoints
  • Amazon Lambda
  • Amazon S3
  • Amazon API Gateway

Clearly, this is a functionality that is widespread, and often used by web developers. As your infrastructure grows and matures, CORS is very likely to see use across your cloud infrastructure.

In the case of Lambda and API Gateway, Amazon provides the following guidance:

“To enable cross-origin resource sharing (CORS) for a proxy integration, you must add Access-Control-Allow-Origin: <domain_name> to the output headers. <domain_name> can be * for any domain name.”

As mentioned above, this works wonderfully, as long as you don’t need the Access-Controls-Allow-Credentials field to be true. If you need credentials, you’ll need to process the user-supplied origin. If you have never deployed CORS before and turn to the Internet for a template, you may end up using one of the many code examples which only reflect the origin and do not provide specific instructions on ensuring CORS is deployed securely.

Realistically, the most secure configuration is a hard-coded allow list that is maintained by the developer. However, as discussed below, even this does not stop CORS from opening up an exploitable hole.

Exploiting Misconfigurations

One of the most common misconfigurations, as mentioned above, is reflecting the user-supplied origin header in the server response, effectively allowing requests from any origin. As an example, consider an AWS Lambda and API Gateway serverless architecture where the Lambda accesses data stored in a DynamoDB instance. If you want to include more than a single domain in the ACAO header (e.g., you have more than one subdomain that will need to access the API), then you’ll need to write a Lambda to handle the headers. Note that while we use AWS and Amazon services here as examples, these same sorts of vulnerabilities can also occur with the same architecture in both Azure and GCP. In the Azure case, this architecture would be comprised of Azure Application Gateway, Azure Functions, and CosmosDB. In GCP, the corresponding services would be Cloud Endpoints, Google Cloud Functions, and BigTable.

Figure 1: Simple CORS-enabled API Gateway Architecture

Now in this case, we can see that a request made to the API Gateway will trigger the lambda which generates the CORS headers. As we mentioned with this misconfiguration – the lambda is simply reflecting the origin provided by the user, and that request is then handed off to the second lambda to make database queries by way of the API gateway. This database can contain whatever sort of information you might access via API but don’t want disclosed to the world (e.g. customer records, API keys, etc.). 

This means that all an attacker needs to do is get an unwitting but authorized user to make the request on their behalf from their domain. This can be attained by any number of methods: script injection, phishing, or any other way that a user might inadvertently navigate to an attacker-controlled resource. When the victim navigates to the attacker controlled resource, the sensitive request is made from the attacker’s origin with the authorized user’s credentials, and CORS allows this to occur, providing the sensitive data back to the attacker.

Impacts of CORS Misconfigurations

Examples of CORS misconfigurations being exploited:

  • A US Department of Defense Website had an improper access control in CORS which allowed an attacker to steal user sessions.
  • A bitcoin exchange had a vulnerability which could steal users’ private API key, allowing all of their BTC to be transferred to an arbitrary address.

These vulnerabilities and others like them underscore the need to verify that your CORS configuration is correct. This means ensuring that you are not simply reflecting the origin that you are provided by the browser, but maintaining an accurate, up-to-date allow list. 

The Cream in Your XSS Coffee

(AUTHOR NOTE: It doesn’t matter if you personally like cream in your coffee. This is just a euphemism. I personally favor a venti Americano with a splash of cream and 3 splenda.)

Using CORS trust relationships, we can actually use even properly configured environments to make a cross-site scripting vulnerability on one site far more damaging. Given an XSS vulnerability on a page which is trusted via CORS, an attacker can retrieve sensitive information from the site which trusts the vulnerable page. 

In this scenario, we’ll use the same API Gateway configuration as above, but assume that it actually does the CORS Origin checks correctly – that is, it looks for a valid subdomain and returns only if the user is authenticated and the request comes from a subdomain which is on an accurate allow list. 

Figure 2: Simple CORS-enabled S3 Front-End for API Gateway Architecture

In this scenario, there is no CORS misconfiguration, but instead the page on the S3 Bucket is vulnerable to Cross-Site Scripting. In this scenario, the attacker exploits that cross-site scripting vulnerability and instead injects JavaScript which retrieves information from the database. All of this happens because the API gateway, and therefore the database, trust the website hosted in the bucket. 

These attacks and more have been detailed in a non-cloud context by the folks over at Portswigger, the makers of Burp Suite. 

Even though these are hypothetical examples, knowing about CORS security is key because cross-domain requests are even more common in the cloud than they are in on-premises systems and so there are more opportunities for these sorts of vulnerabilities to exist and be exploited. So how do we deal with attacks that target our CORS-enabled cloud applications?

Thinking About CORS Under ATT&CK

The MITRE ATT&CK framework provides a useful way of looking at where CORS, whether configured correction and used to exploit trust relationships or misconfigured and exploited, can impact your enterprise and the ripple effects of ensuring that your web applications are safe from cross-site scripting. In this section, we summarize the associated tactics and techniques.

Enticing a user to access a page with a malicious script

Tactics: User Execution
Techniques: Drive-by Compromise, Spearphishing Link
Mitigations: Restrict Web-Based Content

Blocking JavaScript is a powerful tool for preventing this entire exploit chain in the first place. Of course, this can be difficult to do generally due to the ubiquity of JavaScript on the modern web. Having an allow list for running Javascript from trusted sources is crucial.
This mitigation is, due to the nature of the attack, the only one in this list designed to protect users on the endpoint rather than protect the application from exploitation.

Using the CORS misconfiguration to gain privileged access via origin reflection

Tactics: Initial Access
Techniques: Attacker in the Browser
Mitigations (proposed): Application Developer Guidance, Vulnerability Scanning

Although MITRE does not currently link Application Developer Guidance to Attacker in the Browser, ensuring CORS is properly configured is an application developer responsibility. Some vulnerability scanners will detect CORS misconfigurations.

 Exploiting cross-site scripting on a vulnerable page

Tactics: Initial Access
Techniques: Exploit Public-Facing Application
Mitigations: Vulnerability Scanning

Cross-site scripting can be challenging to notice in code review, but there are lots of good tools for automatically finding cross-site scripting. In particular, input validation is one of the most powerful tools for mitigating XSS.

Exploiting the trust relationship between the page and the API gateway

Tactics: Privilege Escalation
Techniques: Process Injection
Mitigations: Vulnerability Scanning

Although conventionally, process injection refers to applications running on the endpoint, here we’re still making the same connection – an application is issuing commands on behalf of an attacker via injected code. By expanding our definition of process injection to include web applications, we cover the case of an application with a cross-site scripting vulnerability making a malicious call on behalf of an attacker.  Unfortunately, the only mitigation is to ensure that applications which are CORS-enabled do not have latent vulnerabilities.

Returning sensitive data from the database

Tactics: Collection
Techniques: Data from Information Repositories
Mitigations: Audit

More than auditing the database itself for sensitive data or for access from unauthorized places, it is crucial to audit the applications which access and allow access to sensitive data. 

Conclusión

If you’re running cloud infrastructure, especially APIs in the cloud, you almost certainly have CORS deployed somewhere. Verifying that you do not have CORS misconfigurations in your cloud apps is a critical step in securing your cloud infrastructure. However, even if you have CORS properly configured, it can bite you if the apps which leverage CORS connections are not themselves secure since CORS can act as an amplifier for any latent vulnerability. By using the Mitre ATT&CK framework, we can create tabletop scenarios which allow us to profile and emulate attacks before they happen and give us a holistic view of our defense posture against certain types of exploits.

Stay informed!

Subscribe for the latest from the Netskope Blog