🔒 CORS Protection Control
Toggle Cross-Origin Resource Sharing protection on API endpoints
Vulnerable

25

Total Devices

21

Active Devices

10

Compliance Issues

6

Departments

7

Device Types

📡 Device API Endpoints

Available APIs for device data access

Public APIs
/cors/api/devices

Basic device information (non-sensitive)

Sensitive APIs (CORS Protected)
/cors/api/devices/detailed

Complete device data including IMEI, phone numbers

/cors/api/devices/locations

Real-time device locations and contact info

⚠️ Security Notice: The detailed device APIs contain sensitive information including IMEI numbers, phone numbers, locations, and personal data. When CORS protection is disabled, these APIs are vulnerable to cross-origin data theft.

🎯 CORS Attack Simulation

Simulate a cross-origin attack to steal device data

To demonstrate the CORS vulnerability:

  1. Ensure you're logged into this MDM dashboard
  2. Disable CORS protection using the toggle above
  3. Visit the evil benefits portal: 🏥 Employee Benefits Portal
  4. Click "Check Device Eligibility" on the evil site
  5. Return here to see the attack results
🔍 What Happens?

The evil site will attempt to steal your device data using your authenticated session. With CORS protection disabled, the attack succeeds. With protection enabled, the browser blocks the response.

📱 Recent Devices (Sample - 20/25)

Device ID Employee Department Device Type OS Version Last Seen Status
CORS-DEV-0001 John Matrix Marketing Samsung Galaxy S24 iOS 17.1 2026-08-16 16:07:49 Compliance Issue
CORS-DEV-0002 James Bond IT Google Pixel 8 Windows 11 2026-08-17 00:07:49 Compliance Issue
CORS-DEV-0003 Neo Anderson Finance iPhone 15 Pro iOS 17.1 2026-08-15 18:07:49 Security Risk
CORS-DEV-0004 Trinity Anderson Finance iPhone 14 Windows 11 2026-08-15 06:07:49 Compliance Issue
CORS-DEV-0005 Jason Bourne Finance Google Pixel 8 Android 14 2026-08-16 00:07:49 Compliant
CORS-DEV-0006 James Bond Sales Surface Pro 9 Android 14 2026-08-17 12:07:49 Security Risk
CORS-DEV-0007 James Bond Marketing Surface Pro 9 Android 14 2026-08-15 21:07:49 Compliant
CORS-DEV-0008 Sarah Connor Sales iPhone 14 iOS 17.1 2026-08-16 00:07:49 Compliance Issue
CORS-DEV-0009 Ethan Hunt HR iPhone 14 Windows 11 2026-08-15 07:07:49 Compliant
CORS-DEV-0010 Neo Anderson Engineering Surface Pro 9 Windows 11 2026-08-15 01:07:49 Compliant
CORS-DEV-0011 John Matrix Engineering MacBook Air M2 Windows 11 2026-08-16 14:07:49 Security Risk
CORS-DEV-0012 John Matrix Engineering iPad Pro Android 14 2026-08-15 14:07:49 Compliant
CORS-DEV-0013 Jason Bourne Finance Surface Pro 9 Windows 11 2026-08-15 21:07:49 Compliant
CORS-DEV-0014 Sarah Connor IT iPhone 14 Windows 11 2026-08-15 09:07:49 Compliant
CORS-DEV-0015 Lara Croft HR iPhone 15 Pro Android 14 2026-08-15 18:07:49 Compliant
CORS-DEV-0016 Lara Croft Marketing iPad Pro iOS 17.1 2026-08-17 16:07:49 Compliant
CORS-DEV-0017 Leon Kennedy Engineering iPhone 15 Pro Windows 11 2026-08-16 10:07:49 Compliance Issue
CORS-DEV-0018 Ethan Hunt Finance MacBook Air M2 Android 14 2026-08-16 02:07:49 Compliant
CORS-DEV-0019 James Bond Engineering Samsung Galaxy S24 Windows 11 2026-08-16 01:07:49 Compliant
CORS-DEV-0020 Jason Bourne Sales iPhone 14 Windows 11 2026-08-15 08:07:49 Compliant

Note: This table shows only basic device information. Sensitive data like IMEI numbers, phone numbers, and locations are available via API endpoints.