Description

Detects insecure CORS (Cross-Origin Resource Sharing) configurations in Django applications that could allow unrestricted cross-origin access. This vulnerability occurs when CORS headers are set with overly permissive values or user-controlled input, potentially enabling malicious websites to make unauthorized requests to the application.

Detection Strategy

• Check if Django framework is imported in the code

• Look for assignments that set CORS-related configurations with insecure values (like '*' or user input)

• Identify response objects where headers related to CORS are set with potentially dangerous values

• Flag cases where Access-Control-Allow-Origin and other CORS headers are configured without proper origin validation

Vulnerable code example

from django.http import HttpResponse

def vulnerable_cors_header(request):
    # SOURCE: Getting user-controlled origin from request headers
    user_origin = request.headers.get('Origin')
    
    response = HttpResponse("Sensitive data")
    # VULNERABLE: Directly reflects untrusted user input into CORS header...

✅ Secure code example

from django.http import HttpResponse

# Define allowed origins at module level
ALLOWED_ORIGINS = ['https://trusted.com', 'https://internal.app.com']

def secure_cors_header(request):
    # Get origin from request headers
    user_origin = request.headers.get('Origin')...