HTML5: CORS Functionality Abuse

Failure to properly restrict cross domain access to sensitive resources might enable an attacker to carry out data theft or content spoofing attacks.

Cross-Origin Resource Sharing (CORS) allows a domain to define a policy for its resources to be accessed by a web page hosted on a different domain using cross domain XML HTTP Requests (XHR). Historically, the browsers restricted XHR requests to abide by the same origin policy. This policy sets the script execution scope to the resources available on the current domain and prohibits any communication to domains outside this scope. However, a few HTML tags, such as SCRIPT, IMG, and IFRAME, are exempt from the same origin policy and allow remote content to be loaded from a different domain. These are secure alternatives for the site that load content from remote domains and require no special permission or cross-domain policy from the hosting domain.
While CORS is supported on all major browsers, it also requires that the domain correctly defines the CORS policy in order to have its resources shared with another domain. These restrictions are managed by access policies typically communicated in specialized response headers, such as:

- Access-Control-Allow-Origin
- Access-Control-Allow-Headers
- Access-Control-Allow-Methods

However, caution should be taken when defining these headers because an overly permissive policy configured at the server level for a domain or directory on a domain can open more content for cross domain access than intended. CORS can allow a malicious application to communicate with victim applications, which can lead to information disclosure, spoofing, data theft, relay, or other attacks.
Implementing CORS can increase an application's attack surface and should be used only when necessary.