Add CORS Misconfiguration Scanner Module (GSoC 2026 – Artemis Extension)

Summary

This PR adds a CORS Misconfiguration Scanner module as a proof-of-concept for GSoC 2026 Project #3 — Extending the Artemis Scanner.

It detects exploitable CORS misconfigurations (CWE-942) where:

• The server reflects arbitrary Origin headers in Access-Control-Allow-Origin
• AND sets Access-Control-Allow-Credentials: true

This combination can allow authenticated cross-origin data access.

What's Included

• Scanning Module

  • artemis/modules/cors_scanner.py
  • Covers:
    • Arbitrary origin reflection
    • null origin
    • Suffix-based bypass cases

• Reporting

  • Reporter integration
  • Jinja2 email template for readable output

• Translations

  • English and Polish .po files

• Severity Mapping

  • cors_misconfiguration → MEDIUM

• Docker

  • Added karton-cors-scanner service

• Tests

  • Unit tests
  • Reporter integration test

• Test App

  • test/data/cors_test_app/ (intentionally vulnerable Flask app)

• Standalone Script

  • poc_cors_verify.py (runs without Artemis infra)

Detection Logic

Findings are reported only if both conditions are met:

1. Server reflects attacker-controlled origin (or uses *)
2. Access-Control-Allow-Credentials: true is present

Reflection alone is not flagged to avoid false positives.

How to Verify

pip install flask requests
python poc_cors_verify.py

[TEST 1] Vulnerable endpoint — reflected Origin + ACAC:true    PASS
[TEST 2] Safe endpoint — ACAO:* without credentials            PASS
[TEST 3] No CORS headers — default deny                        PASS
[TEST 4] Unit checks on is_misconfigured()                     PASS