UNESCO — CORS Misconfiguration leads to Cross-Site Web-Socket Hijacking and exfiltrate chat history…

CORS Misconfiguration on xyz.unesco.org through permissive origin reflection allows attacker to perform Cross-Site Web-Socket Hijacking (CSWSH) and exfiltrate chat history and user session data

Severity: HIGH (CVSS 8.6) CWE: CWE-942 — Permissive Cross-domain Policy with Untrusted Domains

Like and Support on LinkedIn also — https://lnkd.in/p/daGwfmiJ

1. SUMMARY

The application xyz.unesco.org (Chainlit AI chatbot on FastAPI/Uvicorn) reflects any origin in the Access-Control-Allow-Origin header with Access-Control-Allow-Credentials: true, including null. The WebSocket endpoint at /ws/socket.io performs no origin validation. This enables Cross-Site WebSocket Hijacking (CSWSH) and credentialed cross-origin data exfiltration.

3. ROOT CAUSE

The CORS middleware reflects the Origin header value verbatim in Access-Control-Allow-Origin without validating against a trusted domain whitelist. The combination with Access-Control-Allow-Credentials: true violates the CORS specification, which prohibits wildcard/reflective origins when credentials are enabled.

4. EVIDENCE

4.1 CORS Preflight — Arbitrary Origin

Request:
curl -s -D - -o nul -X OPTIONS "https://example.com/user" \
 -H "Origin: https://evil.com" \
 -H "Access-Control-Request-Method: GET"
Response:
 HTTP/1.1 200 OK
 access-control-allow-origin: https://evil.com
 access-control-allow-credentials: true
 access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
 access-control-allow-headers: authorization, content-type
 access-control-max-age: 86400

Request:
curl -s -D - -o nul -X OPTIONS "https://example.com/user" \
 -H "Origin: https://evil.com" \
 -H "Access-Control-Request-Method: GET"
Response:
 HTTP/1.1 200 OK
 access-control-allow-origin: https://evil.com
 access-control-allow-credentials: true
 access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
 access-control-allow-headers: authorization, content-type
 access-control-max-age: 86400

4.2 CORS Preflight — Null Origin

Request:
 curl -s -D - -o nul -X OPTIONS "https://example.com/user" \
 -H "Origin: null" \
 -H "Access-Control-Request-Method: GET"
Response:
 access-control-allow-origin: null
 access-control-allow-credentials: true

Request:
 curl -s -D - -o nul -X OPTIONS "https://example.com/user" \
 -H "Origin: null" \
 -H "Access-Control-Request-Method: GET"
Response:
 access-control-allow-origin: null
 access-control-allow-credentials: true

4.3 WebSocket — No Origin Validation

Request:
 curl -s "https://example.com/ws/socket.io/?EIO=4&transport=polling" \
 -H "Origin: https://evil.com"
Response:
 HTTP/1.1 200 OK
 access-control-allow-origin: https://evil.com
 access-control-allow-credentials: true
 0{"sid":"…","upgrades":["websocket"],"pingInterval":25000}

Request:
 curl -s "https://example.com/ws/socket.io/?EIO=4&transport=polling" \
 -H "Origin: https://evil.com"
Response:
 HTTP/1.1 200 OK
 access-control-allow-origin: https://evil.com
 access-control-allow-credentials: true
 0{"sid":"…","upgrades":["websocket"],"pingInterval":25000}

4.5 Information Leakage

Request:
 curl -s "https://example.com/project/translations" -H "Origin: https://evil.com"
Result: Internal email data.ai@unesco.org leaked via i18n endpoint.

Request:
 curl -s "https://example.com/project/translations" -H "Origin: https://evil.com"
Result: Internal email data.ai@unesco.org leaked via i18n endpoint.

5. EXPLOITATION SCENARIO

Attack Flow:

1. Victim visits attacker's page (evil.com)
2. Attacker's JavaScript sends credentialed fetch to xyz.unesco.org
3. Server reflects evil.com origin + credentials: true
4. Browser allows response read
5. Attacker reads victim's chat history, profile, session tokens
6. WebSocket connection established — real-time messages intercepted
7. All data exfiltrated to attacker's server

POC:

Reported by : J3RRY_H4CK