CORS*, Additional CORS Checks
Summary: PortSwigger's BApp Store lists "CORS* - Additional CORS Checks," a Burp Suite extension by Yves Bieri (version 0.9.1, last updated 08 June 2022) that tests websites for CORS misconfigurations, including arbitrary origin reflection and subtler cases where a regex is not properly configured. The extension raises an issue when a dangerous origin is reflected, rates it high if "Access-Control-Allow-Credentials: true" is also set and low otherwise, and leaves it to the user to decide whether the reflected Origin is intended, such as a CDN, or a security issue.
Why it matters: The tool's own design concedes the hard part: a reflected Origin only becomes a high-rated finding when credentials are allowed, and the final call on whether that reflection is intended is left to a human, so a CDN-style origin that looks legitimate can pass review while still carrying credentialed access.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026