Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server
1–10 of 18 posts
Re: Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server
#2These are pretty beautiful attacks, which build off what I think are two basic issues Apache deals with that other webservers don't:
* A maybe ill-advised architecture where lots of independently-developed modules cooperate to handle a request, all working on an over-complicated under-specified request "object".
* The requirement to honor `httpd.conf` file structures dating back to the 1990s, which has led to legacy support code paths that do surprising things.
The core of this article is a two-step attack that exploits (1) the fact that modules alternately interpret `request->filename` as a filename and as a URL, which allows attackers to truncate URLs at path separator characters, which by itself can slip you past some basic ACLs, and (2) the fact that Apache will try to serve request both with and without the `DocumentRoot` applied, which, combined with the first attack pattern, means that config directives that have attacker-controlled targets give attackers full filesystem access. Hilarity ensues.
There's a really slick attack here that takes you from CRLF-injection to SSRF and RCE, which is neat, because CRLF-injection ("header splitting") would ordinarily not be that interesting of an attack.
This is great stuff that just makes me wish more people ran Apache in 2024.
Re: Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server
#3These are pretty beautiful attacks, which build off what I think are two basic issues Apache deals with that other webservers don't: * A maybe ill-advised architecture where lots of independently-developed modules cooperate to handle a request, all working on an over-complicated under-specified request "object". * The requirement to honor `httpd.conf` file structures dating back to the 1990s, which has led to legacy…
Why would you want more people to run Apache? If you're running it you should cover it up with some sort of carefully configured reverse proxy.
Re: Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server
#4These are pretty beautiful attacks, which build off what I think are two basic issues Apache deals with that other webservers don't: * A maybe ill-advised architecture where lots of independently-developed modules cooperate to handle a request, all working on an over-complicated under-specified request "object". * The requirement to honor `httpd.conf` file structures dating back to the 1990s, which has led to legacy…
Why would you want more people to run Apache? If you're running it you should cover it up with some sort of carefully configured reverse proxy.
So that I could play with bugs like these!
Re: Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server
#5So my public web servers will start seeing a lot more spam requests that contain %0D%0A or end in %3F?
Really impressive to find that many exploitable issues without once relying on a buffer overflow.
Re: Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server
#6The lesson I've learned from this: Ambiguity may not always resolve. If some technical details in a spec seem confusing or ambiguous between two contradictory options, then half of the implementations will probably do option #1, the other will half will do option #2 and some may do both at the same time.
Re: Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server
#7The AddHandler stuff I've seen exploited or attempted in the last 10 years
Re: Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server
#8These are pretty beautiful attacks, which build off what I think are two basic issues Apache deals with that other webservers don't: * A maybe ill-advised architecture where lots of independently-developed modules cooperate to handle a request, all working on an over-complicated under-specified request "object". * The requirement to honor `httpd.conf` file structures dating back to the 1990s, which has led to legacy…
Why would you want more people to run Apache? If you're running it you should cover it up with some sort of carefully configured reverse proxy.
“Carefully” is very load bearing.
A similar but different class of issues common to web stacks is when you have proxies and multiple layers of HTTP “things”, especially when they parse data differently (eg: nginx fronting Apache)
Re: Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server
#9These are pretty beautiful attacks, which build off what I think are two basic issues Apache deals with that other webservers don't: * A maybe ill-advised architecture where lots of independently-developed modules cooperate to handle a request, all working on an over-complicated under-specified request "object". * The requirement to honor `httpd.conf` file structures dating back to the 1990s, which has led to legacy…
Why would you want more people to run Apache? If you're running it you should cover it up with some sort of carefully configured reverse proxy.
Because I wasn't hurting enough without having to worry about parser alignment.
Re: Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server
#10[deleted]