Description

Detects insecure CORS configurations in C# applications where wildcard origins (*) are set in HttpWebRequest headers. This creates a security risk by allowing any domain to make cross-origin requests to the application, potentially exposing sensitive data to malicious websites.

Detection Strategy

• Check if the System.Net namespace is imported in the C# code

• Look for header modifications on HttpWebRequest objects

• Identify CORS-related headers (e.g. Access-Control-Allow-Origin)

• Flag cases where the header value is set to a wildcard (*) which allows any origin

• Report a vulnerability when CORS headers are configured with unrestricted wildcard origins

Vulnerable code example

using System.Net;

public void MakeRequest() 
{
    HttpWebRequest request = (HttpWebRequest)WebRequest.Create("https://api.example.com");
    // Vulnerable: Using wildcard allows any origin to access the API
    request.Headers["Access-Control-Allow-Origin"] = "*";
    request.Headers["Access-Control-Allow-Methods"] = "GET,POST,PUT,DELETE";...

✅ Secure code example

using System.Net;

public void MakeRequest() 
{
    HttpWebRequest request = (HttpWebRequest)WebRequest.Create("https://api.example.com");
    // Safe: Restricting access to specific trusted origin
    request.Headers["Access-Control-Allow-Origin"] = "https://trusted-client.example.com";
    // Safe: Limiting allowed methods to only those needed...