Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular sites with Apache server-status enabled (leaking internal details)

blog.sucuri.net

Post reply on HN
Print view View original

11–20 of 47 posts

Re: Popular sites with Apache server-status enabled (leaking internal details)

#11

Post by wzm »

This can also lead to DOS issues, as I understand it, the Apache server-status pages are very computationally intensive to produce, and it requires stopping and polling every child.

Something like

    SetHandler server-status

    Order Deny,Allow

    Deny from all

    Allow from 10.0.0.0/24

(where 10.0.0.0 is your local network range) will prevent external requests. This is mentioned in the linked through Apache documentation.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#12

Post by jd »

To those who think it isn't a big deal: when GET requests are made public you can snoop "password reset links" and similar to to get access to somebody else's account. Even when developers use best practices GET request paths can leak sensitive information.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#13

Post by perezbox »

jd wrote: post #12

To those who think it isn't a big deal: when GET requests are made public you can snoop "password reset links" and similar to to get access to somebody else's account. Even when developers use best practices GET request paths can leak sensitive information.

Hi JD

You're right on the GET requests.. :) ..

Any attacker, pentesters, worth their salt would be able to garner some good info from this.

See reference to vulnerable soft in the post published.

Cheers.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#14

Post by davedd »

Another issue we identified is that you can find those "hidden" admin panel or URLs that shouldn't be known to the outside, by just refreshing the page a few times and checking all requests.

It is not a best practice, but some companies do and it makes easier for those to be found.

thanks,

Re: Popular sites with Apache server-status enabled (leaking internal details)

#16

Post by alanctgardner2 »

perezbox wrote: post #13
jd wrote: post #12

To those who think it isn't a big deal: when GET requests are made public you can snoop "password reset links" and similar to to get access to somebody else's account. Even when developers use best practices GET request paths can leak sensitive information.

Hi JD You're right on the GET requests.. :) .. Any attacker, pentesters, worth their salt would be able to garner some good info from this. See reference to vulnerable soft in the post published. Cheers.

I think you might mean 'garner'? Just a heads up

Re: Popular sites with Apache server-status enabled (leaking internal details)

#17

Post by perezbox »

alanctgardner2 wrote: post #16
perezbox wrote: post #13

Earlier quoted context omitted.

Hi JD You're right on the GET requests.. :) .. Any attacker, pentesters, worth their salt would be able to garner some good info from this. See reference to vulnerable soft in the post published. Cheers.

I think you might mean 'garner'? Just a heads up

Thanks for the heads up. Updated.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#19

Post by ludwigvan »

marcuspovey wrote: post #15

You've got to watch this... Apache typically limits this to localhost, but if you use squid as a reverse proxy (quite common) then you can see this easily being exposed since all requests will appear to come from the local machine.

Similarly, if you are using nginx in front of apache, watch out.
Post reply on HN