Re:Pi-hole Remote Code Execution
by 0x0 on Saturday March 28, 2020 @08:04PM
(#22715262)
Does this pihole admin interface perform any kind of CSRF protection, or can this be exploites by any random website as long as the victim has a browser tab with a valid session?
[ Parent
| on HN ]
Re:Pi-hole Remote Code Execution
by itsnotlupus on Sunday March 29, 2020 @01:44AM
(#22716731)
There's a csrf token set in a php session that's hard to guess that needs to be provided in form data, yes.
Probably difficult to exploit that way without first finding another bug to retrieve that token from a random origin.
Requires a POST that would hit CORS pretty hard
Re:Pi-hole Remote Code Execution
by deathanatos on Saturday March 28, 2020 @11:22PM
(#22716095)
Not all POST requests require a CORS preflight. In particular, "normal" form submissions, like the type that are accessed via $_POST in the article, do not.
Specifically, "simple requests" do not, covered here[1]. This case is POST, with a Content-Type of application/x-www-form-urlencoded. (The rule of thumb you can use is that these were all essentially possible to send prior to CORS even existing. To send a POST, you would construct a form tag with the inputs filled in with the desired values, set the target URL to the "victim" site, and have JS submit the form.)
[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simpl...