Setting an overly permissive Cross-Origin Resource Sharing (CORS) policy allows malicious websites to read responses from your application on behalf of authenticated users.

Why is this an issue?

Same-origin policy in browsers prevents JavaScript from making cross-origin HTTP requests to resources with a different origin (domain, protocol, or port). The Cross-Origin Resource Sharing (CORS) mechanism allows servers to relax this restriction by including Access-Control-Allow-Origin response headers that tell browsers which origins are permitted.

Setting the Access-Control-Allow-Origin header to a wildcard (*) or dynamically reflecting a user-supplied Origin header without validation completely disables same-origin protection for the affected resource.

What is the potential impact?

Sensitive data exposure

When CORS restrictions are disabled, a malicious website visited by an authenticated user can issue cross-origin requests to the vulnerable application and read the responses. This allows attackers to steal sensitive data accessible to the victim, such as account details, API keys, or private application data.

Account takeover

If the application is also configured with Access-Control-Allow-Credentials: true, the browser will include cookies and HTTP authentication headers in cross-origin requests. Attackers can then perform authenticated operations on behalf of the victim, potentially leading to full account takeover or unauthorized data modification.

How to fix it

Configure the Tomcat CORS filter with specific allowed origins.

Code examples

Noncompliant code example

<!-- Tomcat 7+ Cors Filter -->
<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
  <init-param>
    <param-name>cors.allowed.origins</param-name>
    <param-value>*</param-value> <!-- Noncompliant -->
  </init-param>
</filter>

Compliant solution

<!-- Tomcat 7+ Cors Filter -->
<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
  <init-param>
    <param-name>cors.allowed.origins</param-name>
    <param-value>https://trusted1.org,https://trusted2.org</param-value>
  </init-param>
</filter>

Resources

Documentation

Standards