I built a security audit tool. Then I pointed it at my own site.

说明与用途

作者使用自托管的 ZAP 和 ExploitDB 堆栈发现并修复了自己网站上的通配符 CORS 头，并通过新扫描验证了修复效果。

问题

A wildcard CORS header (Access‑Control‑Allow‑Origin: *) was exposed on the author’s own domain, allowing any origin to access the site’s resources.

结果

The author discovered a critical CORS misconfiguration on his own site, corrected it by adjusting CDN settings, and validated the fix with a fresh scan, highlighting the importance of verifying audit results rather than relying on cached data.

工作流

• 1. Run OWASP ZAP scan against the target URL.
• 2. Identify the Access‑Control‑Allow‑Origin: * header in the scan results.
• 3. Trace the header source to Vercel CDN default settings.
• 4. Update the CDN configuration to specify allowed origins only.
• 5. Generate a fresh URL to avoid ZAP cache and rerun the scan.
• 6. Verify that the new scan shows the corrected header and no wildcard.
• 7. Document the change and confirm no functional regressions.

证据

It came back with a wildcard CORS header.

来源

Scoping the header down to the actual allowed origins took minutes.

来源

ZAP caches session results. Rerun a scan against the same URL you just tested and you can get a clean read that has nothing to do with whether your fix actually worked.

来源