Popular sites with Apache server-status enabled (leaking internal details)

#1

Post by davedd » Tue, Oct 30, 2012, 9:11 PM UTC

Re: Popular sites with Apache server-status enabled (leaking internal details)

#2

Post by perezbox » Tue, Oct 30, 2012, 9:13 PM UTC

This is a classic case of bad security posture by larger enterprises.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#3

Post by code_duck » Tue, Oct 30, 2012, 9:35 PM UTC

Sweet, I'm interested in checking out all their configs!

Re: Popular sites with Apache server-status enabled (leaking internal details)

#4

Post by MasterScrat » Tue, Oct 30, 2012, 9:40 PM UTC

Aren't the exposed client IPs at http://php.net/server-status/ a pretty big deal??

Re: Popular sites with Apache server-status enabled (leaking internal details)

#5

Post by pquerna » Tue, Oct 30, 2012, 9:51 PM UTC

MasterScrat wrote: post #4

Aren't the exposed client IPs at http://php.net/server-status/ a pretty big deal??

FWIW, at least on apache.org, this is intentional:

http://www.apache.org/server-status

Additionally, mod_info is enabled, which lets you read nearly the entire running configuration:

http://www.apache.org/servinfo

Re: Popular sites with Apache server-status enabled (leaking internal details)

#6

Post by nthitz » Tue, Oct 30, 2012, 9:52 PM UTC

Site is down for me, but I thought we agreed last time this was on HN it wasn't really that big of a deal..

Previous discussion: http://news.ycombinator.com/item?id=4661625

Re: Popular sites with Apache server-status enabled (leaking internal details)

#7

Post by perezbox » Tue, Oct 30, 2012, 9:55 PM UTC

nthitz wrote: post #6

Site is down for me, but I thought we agreed last time this was on HN it wasn't really that big of a deal.. Previous discussion: http://news.ycombinator.com/item?id=4661625

When was it last on HN? Don't remember seeing it.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#8

Post by perezbox » Tue, Oct 30, 2012, 9:58 PM UTC

nthitz wrote: post #6

Site is down for me, but I thought we agreed last time this was on HN it wasn't really that big of a deal.. Previous discussion: http://news.ycombinator.com/item?id=4661625

It's back up now.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#9

Post by davedd » Tue, Oct 30, 2012, 9:59 PM UTC

Site is back up.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#10

Post by perezbox » Tue, Oct 30, 2012, 10:01 PM UTC

nthitz wrote: post #6

Site is down for me, but I thought we agreed last time this was on HN it wasn't really that big of a deal.. Previous discussion: http://news.ycombinator.com/item?id=4661625

Thanks for the update withe link.

Yeah, not sure I'd agree with it not being a big deal. Especially with the type of recon you can do on this information as an attacker.

TP