Lab: CORS vulnerability with trusted insecure protocols
Summary: PortSwigger's lab presents a website with an insecure CORS configuration that trusts all subdomains regardless of protocol, and the task is to craft JavaScript that uses CORS to retrieve the administrator's API key and submit it via an exploit server. The lab notes that a man-in-the-middle attack could hijack a connection to an insecure subdomain and inject malicious JavaScript to exploit the configuration, but since the lab environment does not allow MITM against the victim, an alternative way of injecting JavaScript into the subdomain is required.
What you should know: A CORS policy that trusts every subdomain regardless of protocol means one insecure subdomain, reachable over plain HTTP, becomes a path to the administrator's API key - the lab's own framing is that a hijacked connection to that subdomain is enough to inject the JavaScript that pulls it out.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026