A Salesforce API access token was exposed to users' browsers during file uploads on IKEA.com's customer support forms, allowing attackers to access unrestricted customer data via the Salesforce REST API. The token lacked proper permission scoping and revealed 465 object types accessible, including customer account names and phone numbers.
A researcher exploited CORS misconfiguration on a Netgear API endpoint that accepted subdomain origins in combination with reflected XSS on a subdomain to exfiltrate sensitive user data (email, age, gender, DOB) via XMLHttpRequest with credentials.
Advanced CORS exploitation techniques demonstrating two real-world cases: chaining XSS vulnerabilities with CORS misconfigurations to leak sensitive data, and bypassing CORS origin validation using special characters in domain names (particularly in Safari) to exploit wildcard subdomain whitelisting. The second technique leverages browser inconsistencies in domain validation to craft malicious origins like 'zzzz.ubnt.com=.evil.com' that pass CORS checks while resolving to attacker-controlled domains.