CORS issue with response headers

• 

  thealetrail · Member · Apr 1, 2019 at 2:53 pm

  • Copy link
  • Add topic to favorites

  I’ve just had a vulnerability raised against a WP system I’ve got which shows a request with which the system thinks is coming from bing.com being treated as a trusted origin & getting various headers applied.

  Example;

  Request:
  GET /wp-json HTTP/1.1
  Origin: http://www.bing.com
  User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate

  Response

  HTTP/1.1 200 OK
  Server: nginx
  Date: Fri, 29 Mar 2019 09:54:17 GMT
  Content-Type: application/json; charset=UTF-8
  Connection: close
  X-Content-Type-Options: nosniff
  Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages
  Access-Control-Allow-Headers: Authorization, Content-Type
  Allow: GET
  Access-Control-Allow-Origin: http://www.bing.com
  Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
  Access-Control-Allow-Credentials: true

  I’m not really sure where the system is defining bing.com as an origin to add these headers to the responses, but I’d love to know how to stop it.

  Can anyone reproduce this issue or offer a suggestion for a correction?

• 

  fstat · Staff · Apr 2, 2019 at 9:31 am

  • Copy link

  Hi there,

  Looks like you’re in the wrong forum. It appears that you’re using the open source WordPress.org software and you need to seek help at these forums:

  https://wordpress.org/support/forums/

  These forums are for WordPress.com hosted sites only. If you want to know more about the differences between WordPress.com and WordPress.org you can read this document:

  WordPress.com vs. WordPress.org

• 

  thealetrail · Member · Apr 2, 2019 at 9:34 am

  • Copy link

  Thanks. I was looking for where to raise issues around security & found this page via google.

  I’ll take my post over there.