I am testing an application, and come across a GET request that returns sensitive info in the response body. (CSRF token to be validated for next request). Since it is a GET request, developer skipped CSRF protection for all the GET requests and only applied to POST or state changing requests. That token will be used for next POST request.
I know using XHR we can accomplish this, but IF CORS is not enabled, or allowed only for particular domain, is it still possible to perform CSRF in such case without XHR?