Description

Detects insecure CORS (Cross-Origin Resource Sharing) configurations in AWS API Gateway resources defined in CloudFormation templates. The vulnerability occurs when CORS headers are configured to allow all origins (*), which may enable unauthorized cross-origin requests and expose the API to potential security risks.

Detection Strategy

• Check CloudFormation template files for API Gateway resource definitions

• Look for CORS configuration settings within API Gateway resources

• Flag resources that use wildcard (*) in the Access-Control-Allow-Origin header

• Report a vulnerability when unrestricted CORS origins are found in the API Gateway configuration

Vulnerable code example

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  ApiMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: OPTIONS
      AuthorizationType: NONE  # Vulnerable: No authentication required
      Integration:...

✅ Secure code example

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  ApiMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: OPTIONS
      AuthorizationType: IAM  # Fixed: Require AWS IAM authentication
      Integration:...