SmartNews CORS PoC

Targets reflect any Origin in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true. This page runs credentialed fetches from origin : if the browser attaches the victim's .smartnews.com cookies, the CSRF token, full profile and session list below are read by this third-party origin and exfiltrated.

Session cookies are SameSite=Lax: modern desktop browsers will NOT attach them to a cross-site fetch (you will see HTTP 401 — still readable because ACAO reflected this Origin, which is the vuln). Cookies DO attach in same-site contexts (XSS / subdomain takeover), legacy browsers, and many in-app webviews: then you get HTTP 200 with live victim data.

1. GET /csrf — accounts.smartnews.com 

not run yet

2. GET /api/account/profile/v2/profile — web.accounts.smartnews.com 

not run yet

3. GET /api/auth/v1/sessions — web.accounts.smartnews.com 

not run yet

Null-origin vector (sandboxed iframe sends Origin: null, also reflected)

The same three fetches run inside an opaque-origin sandboxed iframe and post results back.

waiting for iframe…

Exfiltration







  How to use / verify
  
# serve from any origin (or open the file directly — file:// sends Origin: null, also reflected)
python3 -m http.server 8000        # then open http://localhost:8000/poc.html

# server-side proof with a live victim session (cookies from devtools):
curl -si -H "Origin: https://evil.example.com" \
     -H "Cookie: __Secure-PSNST=...; __Secure-PSNSI=...; __Secure-PSNDTK=...; SNCSRFT=..." \
     -H "Sn-Csrf-Token: " -H "Sn-Params-Platform: web" \
     -H "Sn-Params-Edition: en_US" -H "Sn-Params-Device-Token: " \
     "https://web.accounts.smartnews.com/api/account/profile/v2/profile"
# expects HTTP 200 with access-control-allow-origin: https://evil.example.com
# and access-control-allow-credentials: true