Description

This detector identifies web applications that fail to implement Cross-Origin Resource Policy (CORP) headers on sensitive resources. CORP prevents unauthorized cross-origin access to resources, protecting against side-channel attacks and data leakage when resources are embedded from other origins.

Detection Strategy

• Sends HTTP requests to target URLs and examines the response headers

• Checks if the HTTP response status is successful (200-299 range)

• Verifies that the Cross-Origin-Resource-Policy header is completely missing from the response

• Determines if the requested URL path is considered sensitive (likely contains API endpoints, admin paths, or user data)

• Reports a vulnerability when all three conditions are met: successful response, missing CORP header, and sensitive path