# Wildcard CORS on local read routes

ACAO * or null on read endpoints exposing local state, files, or imports

_Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; latest 2026-10-19. Updated 2026-11-02._

## How it works
A response carries `Access-Control-Allow-Origin: *` (or `null`) on a route that returns sensitive data. The browser's same-origin policy is the only thing stopping a random website from reading that data; a wildcard header removes it. The assumption that breaks is "only our own page will read this response." Any origin the victim visits can now read it, because the browser attaches the wildcard to the response and lets the calling script see the body. This matters most when the data is local-only (loopback service, `file://` content) and the developer added the wildcard to make a dashboard or import work across ports or schemes [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md)[E3](https://bugbountylibrary.com/r/h1%3A375329.md).

## Where it shows up
- A single shared response helper (e.g. `_send_json`) that hardcodes the wildcard for every route, including unauthenticated GETs [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md)
- Localhost/loopback status or dashboard servers on a fixed port, called from a page served on another port [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md)
- `ACAO: *` or `ACAO: null` on responses that return file contents or `file://` resources [E3](https://bugbountylibrary.com/r/h1%3A375329.md)
- Read routes returning private files, control-plane state, or config with no auth [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md)
- Caller-controlled leading bytes in a response (JSONP callback) combined with a client that tolerates trailing data [E1](https://bugbountylibrary.com/r/h1%3A10373.md)

## How to review
Find every place a CORS header is emitted, then map which routes flow through it. The invariant: a response readable cross-origin must contain no data the requesting origin is not entitled to. For each wildcard route, ask what the body contains and whether it is local state, files, or secrets. Check whether the wildcard is set centrally (one helper) or per-route; central setting means every route inherits it. Confirm whether `null` origins (sandboxed iframes, `file://`) are accepted. For JSONP, check whether the callback parameter controls the first bytes and whether the client parser ignores trailing garbage [E1](https://bugbountylibrary.com/r/h1%3A10373.md).

## How finders spotted it
- Traced all responses through the single `_send_json` helper, saw the hardcoded wildcard, then tried to refute it by testing writes, path traversal, extension allowlists and dry-run behavior; all held, so impact stayed read-only [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md)
- Noticed the browser returned `ACAO: *` for local HTML files and hypothesized HTML imports could cross the local-file boundary [E3](https://bugbountylibrary.com/r/h1%3A375329.md)
- Observed JSONP let the caller control the first response bytes, then hypothesized a different file type could be smuggled as the callback [E1](https://bugbountylibrary.com/r/h1%3A10373.md)

## Variants seen
- Wildcard on a loopback status server exposing control-plane state and private Markdown files [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md)
- Wildcard on `file://` HTML responses enabling `link[rel=import]` reads of local files [E3](https://bugbountylibrary.com/r/h1%3A375329.md)
- Caller-controlled leading bytes (JSONP callback) letting a SWF be served from the target origin [E1](https://bugbountylibrary.com/r/h1%3A10373.md)

## Impact and severity
Read-only cross-origin access to local state and private files [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md), local file disclosure via imports [E3](https://bugbountylibrary.com/r/h1%3A375329.md), and authenticated cross-origin reads on ~45% of top Alexa sites in the JSONP/SWF case [E1](https://bugbountylibrary.com/r/h1%3A10373.md). Impact rises with what the read route returns and how widely the wildcard is applied; chaining with another flaw raised severity in [E3](https://bugbountylibrary.com/r/h1%3A375329.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **loopx (pip)** >= 0.0.1, < 0.4.5, fixed in 0.4.5: LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files (CVE-2026-108372). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md. Fix: https://github.com/loopx-project/loopx/commit/838720fba42bd22f71b5bb763ec406f7bdf4c940

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A10373.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md
- E3: https://bugbountylibrary.com/r/h1%3A375329.md