CORS || Bypass CORS Misconfiguration Leads to Sensitive Exposure POC || Cashfree || Bug Bounty

[@thechannelofmine]

You already have access to these endpoints + there's no sensitive information inside them only public info, it's an informative in the best case.

[@Adarsh.-.]

Bro i got my domain reflection in request but when i add the target in HTML code and try to open it, it's giving me 403. Any idea how to bypass this?

[@cyber_india]

This vulnerability is N/A

[@pra15mesh]

where did you reported this vulnerability? like do they have bb program or email from website only?

[@baraamansi7637]

Bro if you can access it by default ,why the need for CORS ?!

[@CybeR_FrosT]

We need to check is there CORS misconfiguration vulnerability or not

[@baraamansi7637]

thanks for the reply dude!!
So if there was proper authorization control on the endpoint you would exploit the CORS misconfiguration ,but in your case its just Sensitive Data Exposure by just navigating to the endpoint ,right??!@@CybeR_FrosT

[@coffinplayz]

can you please explain both exploit bcz i know first one but not second...also the given link of github have not that script plz paste it in comment if possoble..

[@kirtimanmohanty7575]

github.com/swisskyrepo/PayloadsAllTheThings/tree/master/CORS%20Misconfiguration

[@CyberNinja-p1t]

bounty?

[@0xSaikat]

how to get the html code ?

[@cinematicRecapss]

is getting the /wp/v2/users/ also a vuln ?

[@CybeR_FrosT]

yup

[@kirtimanmohanty7575]

But nowadays this is only informative or N/A.

[@brice2825]

Bro , did you buy burpsuite professional or crack ?

[@CybeR_FrosT]

Crack😉

[@brice2825]

oh okay@@CybeR_FrosT

[@texashighered9539]

​@@CybeR_FrosThow do you get cracked one

[@SankoIGL]

What is the Bypass here?

[@CybeR_FrosT]

CORS mechanism

[@deglorexgaming9273]

need both scripts...
where i will get?

[@CybeR_FrosT]

github.com/swisskyrepo/PayloadsAllTheThings/blob/master/CORS%20Misconfiguration/README.md

[@monKeman495]

rewarded ?

[@CybeR_FrosT]

Yup💲💲💲💲😉

[@jwd42]

​@@CybeR_FrosT1000$ 😅I know

[@lukeastorw]

critical??

[@CybeR_FrosT]

Medium

[@Digital_Hawks7]

N/A😂

[@jwd42]

Platform.... Hackerone?Yogosha😊

[@CybeR_FrosT]

Dorking bro

[@jwd42]

Bro i message you on LinkedIn

[@CybeR_FrosT]

Ok I'll check