CORS || Bypass CORS Misconfiguration Leads to Sensitive Exposure POC || Cashfree || Bug Bounty

[@thechannelofmine]

You already have access to these endpoints + there's no sensitive information inside them only public info, it's an informative in the best case.

[@cyber_india]

This vulnerability is N/A

[@Adarsh.-.]

Bro i got my domain reflection in request but when i add the target in HTML code and try to open it, it's giving me 403. Any idea how to bypass this?

[@pra15mesh]

where did you reported this vulnerability? like do they have bb program or email from website only?

[@baraamansi7637]

Bro if you can access it by default ,why the need for CORS ?!

[@CybeR_FrosT]

We need to check is there CORS misconfiguration vulnerability or not

[@baraamansi7637]

thanks for the reply dude!! So if there was proper authorization control on the endpoint you would exploit the CORS misconfiguration ,but in your case its just Sensitive Data Exposure by just navigating to the endpoint ,right??!@@CybeR_FrosT

[@cinematicRecapss]

is getting the /wp/v2/users/ also a vuln ?

[@CybeR_FrosT]

yup

[@kirtimanmohanty7575]

But nowadays this is only informative or N/A.

[@coffinplayz]

can you please explain both exploit bcz i know first one but not second...also the given link of github have not that script plz paste it in comment if possoble..

[@kirtimanmohanty7575]

github.com/swisskyrepo/PayloadsAllTheThings/tree/master/CORS%20Misconfiguration

[@0xSaikat]

how to get the html code ?

[@CyberNinja-p1t]

bounty?

[@deglorexgaming9273]

need both scripts... where i will get?

[@CybeR_FrosT]

github.com/swisskyrepo/PayloadsAllTheThings/blob/master/CORS%20Misconfiguration/README.md

[@KaitoIGL]

What is the Bypass here?

[@CybeR_FrosT]

CORS mechanism

[@brice2825]

Bro , did you buy burpsuite professional or crack ?

[@CybeR_FrosT]

Crack😉

[@brice2825]

oh okay@@CybeR_FrosT

[@texashighered9539]

​@@CybeR_FrosThow do you get cracked one

[@monKeman495]

rewarded ?

[@CybeR_FrosT]

Yup💲💲💲💲😉

[@jwd42]

​@@CybeR_FrosT1000$ 😅I know

[@lukeastorw]

critical??

[@CybeR_FrosT]

Medium

[@Digital_Hawks7]

N/A😂

[@jwd42]

Platform.... Hackerone?Yogosha😊

[@CybeR_FrosT]

Dorking bro

[@jwd42]

Bro i message you on LinkedIn

[@CybeR_FrosT]

Ok I'll check