# CORS misconfiguration leads to users information disclosure at https://studyroom.line.me

CORS misconfiguration on StudyRoom API let a malicious page read a victim's profile endpoint, which over-returned PII, leaking user data on click.

- Payout: hidden
- Severity: medium
- Program: LY Corporation
- Found by: duahaubadao
- Disclosed: 2020-11-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/924951
- Library page: https://bugbountylibrary.com/r/h1%3A924951
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium technique:recon vuln:cors vuln:info-disclosure

**Target:** StudyRoom API server (studyroom.line.me)
**Root cause:** CORS policy on the StudyRoom API server was misconfigured, allowing cross-origin reads and bypassing SOP. The profile API also returned more personal information than necessary.
**Steps:**
1. Host a malicious page that issues a cross-origin fetch to the StudyRoom profile API endpoint
2. Victim visits the page; browser sends credentialed request to studyroom.line.me API
3. Misconfigured CORS headers allow the response to be read cross-origin
4. Attacker exfiltrates the over-returned profile PII from the response
**Exploitation:** Attacker crafts a malicious webpage that triggers a cross-origin request to the StudyRoom profile API; when a logged-in victim visits it, the misconfigured CORS headers let the attacker's JS read the response containing excess personal information, exfiltrating it.
**Insight:** Check CORS on authenticated API endpoints and compare the response body against what the UI actually needs — over-returned PII turns a CORS misconfig into a real data leak and often earns a PII bonus.