HTML5: CORS Functionality Abuse

Failure to properly restrict cross domain access to sensitive resources could allow an attacker to carry out data theft or content spoofing attacks.

Cross-Origin Resource Sharing, commonly referred to as CORS, is a technology that allows a domain to define a policy for its resources to be accessed by a web page hosted on a different domain using cross domain XML HTTP Requests (XHR). Historically, the browsers have restricted XHR requests to abide by the same origin policy. This policy sets the script execution scope to the resources available on the current domain and prohibits any communication to domains outside this scope. However, a few HTML tags, such as SCRIPT, IMG, and IFRAME, are exempt from the same origin policy and allow remote content to be loaded from a different domain. These are secure alternatives for the site that loads contents from remote domain and no special permission or cross-domain policy is required from hosting domain.
While CORS is supported on all major browsers, it also requires that the domain correctly defines the CORS policy in order to have its resources shared with another domain. These restrictions are managed by access policies typically communicated in specialized response headers, such as:

- Access-Control-Allow-Origin
- Access-Control-Allow-Headers
- Access-Control-Allow-Methods

However, caution should be taken when defining these headers because an overly permissive policy configured at server level for domain or directory on a domain can open more content for cross domains access than intended. CORS can allow a malicious application to communicate with victim application in an inappropriate way leading to information disclosure, spoofing, data theft, relay or other attacks.
Implementing CORS can increase an application's attack surface and should be used only when necessary.