Re:Pi-hole Remote Code Execution
by deathanatos on Saturday March 28, 2020 @11:22PM
(#22716095)
Not all POST requests require a CORS preflight. In particular, "normal" form submissions, like the type that are accessed via $_POST in the article, do not.
Specifically, "simple requests" do not, covered here[1]. This case is POST, with a Content-Type of application/x-www-form-urlencoded. (The rule of thumb you can use is that these were all essentially possible to send prior to CORS even existing. To send a POST, you would construct a form tag with the inputs filled in with the desired values, set the target URL to the "victim" site, and have JS submit the form.)
Specifically, "simple requests" do not, covered here[1]. This case is POST, with a Content-Type of application/x-www-form-urlencoded. (The rule of thumb you can use is that these were all essentially possible to send prior to CORS even existing. To send a POST, you would construct a form tag with the inputs filled in with the desired values, set the target URL to the "victim" site, and have JS submit the form.)
[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simpl...