4 ms·
Does this pihole admin interface perform any kind of CSRF protection, or can this be exploites by any random website as long as the victim has a browser tab wit
by 0x0 7y ago
Does this pihole admin interface perform any kind of CSRF protection, or can this be exploites by any random website as long as the victim has a browser tab with a valid session?
- jrwr 7y agoRequires a POST that would hit CORS pretty hard
- py3001 7y agodns rebinding could make it work, thats not the question
- deathanatos 7y agoNot all POST requests require a CORS preflight. In particular, "normal" form submissions, like the type that are accessed via $_POST in the article, do not. Specifically, "simple requests" do not, covered here[1]. This case is POST, with a Content-Type of application/x-www-form-urlencoded. (The rule of thumb you can use is that these were all essentially possible to send prior to CORS even existing. To send a POST, you would construct a form tag with the inputs filled in with the desired values, set the target URL to the "victim" site, and have JS submit the form.) [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simple_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simpl...
- itsnotlupus 7y agoThere's a csrf token set in a php session that's hard to guess that needs to be provided in form data, yes. Probably difficult to exploit that way without first finding another bug to retrieve that token from a random origin.