Description

Detects insecure CORS (Cross-Origin Resource Sharing) configurations in C# applications where wildcards or overly permissive origin patterns are used. This creates a security risk by potentially allowing unauthorized websites to make cross-origin requests to your application.

Detection Strategy

• Scans for CORS configuration code in C# applications

• Identifies when origin settings use wildcard patterns like '*' or permissive patterns that allow all domains

• Reports vulnerability when CORS is configured to accept requests from any origin without proper restrictions

• Checks CORS policy builders and middleware configuration methods for insecure settings

Vulnerable code example

using Microsoft.AspNetCore.Cors;

public class ApiController
{
    // VULNERABLE: Enables CORS for all origins with full access
    [EnableCors(origins: "*", headers: "*", methods: "*")] 
    public class ProductsController : ApiController
    {...

✅ Secure code example

using Microsoft.AspNetCore.Cors;

public class ApiController
{
    // Secure: Explicitly specifies allowed origins, methods and headers
    [EnableCors(origins: "https://example.com,https://api.example.com", 
                headers: "Content-Type,Authorization", 
                methods: "GET,POST")] ...