Bypassing header validation

Question

I have made a script that can be used for exploiting CORS misconfiguration. The script works fine but if I want to send an extra header to the request by
xhttp.setRequestHeader("test_header", "test_value")

It first sends the pre-flight(OPTIONS) request that contains
Access-Control-Request-Headers: header_name

which the server denies and cancels further requests.

Problem Scenario: Suppose there is one header "test_header" which is allowed by the server

Original request:
sending "test_header"

Original response:

Access-Control-Allow-Headers: test_header

Success


Now sending the same header via CORS script:
xhttp.setRequestHeader("test_header", "test_value")

Sends a pre-flight request with Access-Control-Request-Headers: test_header.

response:

HTTP/1.1 200 OK
Content-Length: 0
Date: Wed, 27 Nov 2019 18:19:29 GMT
Connection: close

No more then this

So is it possible to add this header in the request without sending options request?
Can the request be proxied somewhere which then adds the header to the server?
Is there a way to send a header to the server from the victim's computer which then validates the header and sends the response?

Answer 1

So is it possible to add this header in the request without sending options request?

No. Anything but "simple" requests will cause a preflight requests. Simple requests are everything you could do without XHR, i.e. with an image include, form submit etc. Adding new headers will result in a non-simple request and thus will cause a preflight request.

Can the request be proxied somewhere which then adds the header to the server?

CORS is only enforced in the browser. If the browser sees this as a simple request since the header is only added by a proxy, then the browser will not send a preflight request.