0

I have made a script that can be used for exploiting CORS misconfiguration. The script works fine but if I want to send an extra header to the request by
xhttp.setRequestHeader("test_header", "test_value")

It first sends the pre-flight(OPTIONS) request that contains
Access-Control-Request-Headers: header_name

which the server denies and cancels further requests.

Problem Scenario: Suppose there is one header "test_header" which is allowed by the server

Original request:
sending "test_header"

Original response:

Access-Control-Allow-Headers: test_header

Success


Now sending the same header via CORS script:
xhttp.setRequestHeader("test_header", "test_value")

Sends a pre-flight request with Access-Control-Request-Headers: test_header.

response:

HTTP/1.1 200 OK
Content-Length: 0
Date: Wed, 27 Nov 2019 18:19:29 GMT
Connection: close

No more then this

So is it possible to add this header in the request without sending options request?
Can the request be proxied somewhere which then adds the header to the server?
Is there a way to send a header to the server from the victim's computer which then validates the header and sends the response?

1

So is it possible to add this header in the request without sending options request?

No. Anything but "simple" requests will cause a preflight requests. Simple requests are everything you could do without XHR, i.e. with an image include, form submit etc. Adding new headers will result in a non-simple request and thus will cause a preflight request.

Can the request be proxied somewhere which then adds the header to the server?

CORS is only enforced in the browser. If the browser sees this as a simple request since the header is only added by a proxy, then the browser will not send a preflight request.

  • but the "test_header" is allowed by the server. it only fails if I send it using setRequestHeader(). otherwise no problem with the response – Akshansh Shrivastava Nov 28 '19 at 8:43
  • @AkshanshShrivastava: Again, CORS is only enforced in the browser. It does not matter if the server will accept the header. It only matters if the header is set by the browser or not - and in the first case a preflight request will be sent by the browser. – Steffen Ullrich Nov 28 '19 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.