Tenable WAS 98983 — Insecure Cross-Origin Resource Sharing (CORS) Configuration

#!/usr/bin/env bash
# cors-check.sh — detects Tenable WAS 98983 (Insecure CORS Configuration)
# Usage: ./cors-check.sh <url>
# Exits 2 = VULNERABLE, 0 = PATCHED, 1 = UNKNOWN/error
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN: usage: $0 <url>" >&2
  exit 1
fi

EVIL_ORIGIN="https://evil.attacker.tld"

# Fetch response headers with spoofed Origin
HEADERS=$(curl -sS -D - -o /dev/null \
  -H "Origin: ${EVIL_ORIGIN}" \
  -H "User-Agent: noisgate-cors-check/1.0" \
  --max-time 15 \
  "$TARGET" 2>/dev/null) || {
    echo "UNKNOWN: curl failed against $TARGET"
    exit 1
}

ACAO=$(echo "$HEADERS" | grep -i '^access-control-allow-origin:' | tr -d '\r' | awk -F': ' '{print $2}')
ACAC=$(echo "$HEADERS" | grep -i '^access-control-allow-credentials:' | tr -d '\r' | awk -F': ' '{print $2}')

if [[ -z "$ACAO" ]]; then
  echo "PATCHED: no Access-Control-Allow-Origin header returned for untrusted origin"
  exit 0
fi

# Case 1: reflected origin
if [[ "$ACAO" == "$EVIL_ORIGIN" ]]; then
  if [[ "${ACAC,,}" == "true" ]]; then
    echo "VULNERABLE: reflected Origin + Allow-Credentials:true — credentialed cross-origin read possible"
    exit 2
  fi
  echo "VULNERABLE: reflected Origin (no credentials, but still unauthenticated data leak risk)"
  exit 2
fi

# Case 2: wildcard with credentials (browser will actually reject this combo, but signal is still a misconfig)
if [[ "$ACAO" == "*" && "${ACAC,,}" == "true" ]]; then
  echo "VULNERABLE: ACAO:* with Allow-Credentials:true (invalid combo, but indicates broken policy)"
  exit 2
fi

# Case 3: explicit allowlist — check if evil origin is NOT reflected
echo "PATCHED: ACAO='$ACAO' does not reflect untrusted origin"
exit 0