Description

Detects insecure CORS (Cross-Origin Resource Sharing) configurations in serverless YAML files that use wildcard origins (*). This misconfiguration allows any domain to make cross-origin requests to the API, potentially exposing sensitive data to malicious websites.

Detection Strategy

• Scan serverless framework YAML configuration files for CORS settings

• Check if CORS origin configurations contain wildcard (*) values

• Verify the CORS configuration is within the correct configuration path structure

• Report a vulnerability when wildcard CORS origins are found in valid configuration paths

Vulnerable code example

service: myapp

functions:
  api-endpoint:
    events:
      - http:
          path: /data
          method: post...

✅ Secure code example

service: myapp

functions:
  api-endpoint:
    events:
      - http:
          path: /data
          method: post...