Acumbamail CORS Vulnerability PoC

This page demonstrates that https://acumbamail.com returns Access-Control-Allow-Origin: *

Test 1: Cross-Origin Read

Testing...

Test 2: CSRF Token Readable (if XSS exists)

Simulated: document.cookie.match(/csrftoken=([^;]+)/)[1]

Test 3: Preflight for DELETE method

Testing...

Attack Chain

1. Attacker hosts this page on evil.com
2. Victim visits while logged into acumbamail.com
3. CORS wildcard allows this page to read acumbamail responses
4. If any XSS exists, attacker steals csrftoken (no HttpOnly)
5. Attacker forges POST requests to change account settings
6. Account compromised