---
title: "Cross-Domain Misconfiguration"
description: "HawkScan test information for plugin 10098: Cross-Domain Misconfiguration"
url: https://docs.stackhawk.com/vulnerabilities/10098/
---

[Back to Index](https://docs.stackhawk.com/vulnerabilities/)

# Cross-Domain Misconfiguration

###### Reference

- **Plugin ID:** 10098
- [**CWE:** 264](https://cwe.mitre.org/data/definitions/264.html)
- **WASC:** 14
- **Risk:** Unknown
- **Type:** Passive
- **Category:** Information Leakage

### Remediation

To remediate the vulnerability of Cross-Domain Misconfiguration, the following steps can be taken:

1. **Configure CORS properly:** Ensure that the Cross-Origin Resource Sharing (CORS) policy is correctly configured on the web server. This involves specifying the allowed origins, methods, headers, and credentials for cross-domain requests.

   Example configuration in Apache `.htaccess` file:

   ```apache
   Header set Access-Control-Allow-Origin "*"
   Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"
   Header set Access-Control-Allow-Headers "Content-Type"
   ```

   Example configuration in Nginx server block:

   ```nginx
   add_header Access-Control-Allow-Origin *;
   add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
   add_header Access-Control-Allow-Headers "Content-Type";
   ```

2. **Limit CORS to necessary domains:** Restrict the allowed origins to only the domains that require access. This helps prevent unauthorized cross-domain requests.

   Example configuration in Apache `.htaccess` file:

   ```apache
   Header set Access-Control-Allow-Origin "https://example.com"
   ```

   Example configuration in Nginx server block:

   ```nginx
   add_header Access-Control-Allow-Origin https://example.com;
   ```

3. **Implement authentication and authorization:** Require authentication and authorization for sensitive resources to further control access to cross-domain requests.

   Example configuration in Apache `.htaccess` file using Basic Authentication:

   ```apache
   AuthType Basic
   AuthName "Restricted Area"
   AuthUserFile /path/to/.htpasswd
   Require valid-user
   ```

   Example configuration in Nginx server block using HTTP Basic Authentication:

   ```nginx
   auth_basic "Restricted Area";
   auth_basic_user_file /path/to/.htpasswd;
   ```

### About

Web browser data loading may be possible due to a Cross-Origin Resource Sharing (CORS) misconfiguration on the web server. CORS is a security mechanism that allows web browsers to make cross-domain requests, but it needs to be properly configured to prevent unauthorized access to sensitive data. When CORS is misconfigured, it can allow attackers to bypass the same-origin policy and access data from other domains.

### Risks

The risks associated with Cross-Domain Misconfiguration include:

- **Data leakage:** Attackers can exploit the misconfiguration to access sensitive data from other domains, potentially leading to data breaches and privacy violations.
- **Cross-Site Request Forgery (CSRF):** Misconfigured CORS can enable CSRF attacks, where an attacker tricks a user into performing unintended actions on a trusted website by leveraging the victim's authenticated session.
- **Unauthorized access:** By bypassing the same-origin policy, attackers can perform actions on behalf of the user, leading to unauthorized access to resources and potential account compromise.
- **Malicious code execution:** If an attacker can inject malicious code into a vulnerable website, they can execute arbitrary scripts in the victim's browser, leading to further exploitation and compromise.