Description

Detects insecure Cross-Origin Resource Sharing (CORS) configurations in TypeScript code that use wildcard (*) origins. Using wildcard origins in CORS allows any domain to access your API resources, potentially exposing sensitive data to malicious websites through cross-origin requests.

Detection Strategy

• Inspects CORS configuration settings in TypeScript code

• Identifies when the Access-Control-Allow-Origin header is set to '*' or derived from an insecure source

• Reports a vulnerability when CORS is configured to accept requests from any origin without restriction

• Examines variable assignments and configuration objects that define CORS settings

• Analyzes middleware and server setup code where CORS policies are typically defined

Vulnerable code example

const express = require('express');
const cors = require('cors');
const app = express();

// Vulnerable: Allows requests from any origin with no restrictions
app.use(cors());

// Vulnerable: Explicitly allowing all origins...

✅ Secure code example

const express = require('express');
const cors = require('cors');
const app = express();

// Define allowed origins and CORS options
const corsOptions = {
  origin: 'https://trusted-domain.com', // Only allow specific trusted domain
  methods: ['GET', 'POST'], // Restrict allowed HTTP methods...