Popular sites with Apache server-status enabled (leaking internal details) • Hacker News Board

Re: Popular sites with Apache server-status enabled (leaking internal details)

#31

Post by tankbot » Wed, Oct 31, 2012, 2:59 AM UTC

Looks like Disney fixed theirs.

Can't believe there are admins at this level that miss this.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#32

Post by jlgreco » Wed, Oct 31, 2012, 3:06 AM UTC

notatoad wrote: post #26

MasterScrat wrote: post #4

Aren't the exposed client IPs at http://php.net/server-status/ a pretty big deal??

Why is that a big deal? Is exposing the public IPs of some random people really an issue?

If there is no reason for it to be public, then it shouldn't be public, no matter how obscure the issues with it may seem to you.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#33

Post by tveita » Wed, Oct 31, 2012, 3:27 AM UTC

jd wrote: post #12

To those who think it isn't a big deal: when GET requests are made public you can snoop "password reset links" and similar to to get access to somebody else's account. Even when developers use best practices GET request paths can leak sensitive information.

Some of the sites at http://urlfind.org/?server-status even keep a session id in the URL -- look for PHPSESSID.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#34

Post by notatoad » Wed, Oct 31, 2012, 3:31 AM UTC

pjscott wrote: post #30

notatoad wrote: post #26

Earlier quoted context omitted.

Why is that a big deal? Is exposing the public IPs of some random people really an issue?

http://furry-incest-porn.xxx/server-status/ Yes, it's potentially an issue.

Sure, for a skeezy site. The parent was talking specifically about php.org, I can't imagine any real risk for a site like that exposing their visitor ip log.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#35

Post by jemfinch » Wed, Oct 31, 2012, 3:56 AM UTC

tankbot wrote: post #31

Looks like Disney fixed theirs. Can't believe there are admins at this level that miss this.

Why do you think Disney has access to high quality admins? Do you know high quality sysadmins who want to work for Disney, or companies like it?

Just because a company is a big name doesn't mean it attracts big talent. Disney is still fishing from the same ocean where all the best engineers went to sexier places.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#36

Post by julianz » Wed, Oct 31, 2012, 4:20 AM UTC

notatoad wrote: post #26

MasterScrat wrote: post #4

Aren't the exposed client IPs at http://php.net/server-status/ a pretty big deal??

Why is that a big deal? Is exposing the public IPs of some random people really an issue?

It's not just that. You can get an idea of the traffic to the site if you watch for a while. When that information might be commercially sensitive then it could be a genuine issue.

For example, nba.com has been averaging about 3 connections and 1021 idle workers while I've been watching it. That's perhaps less traffic than you might expect? I don't know, but if I were paying for ad space I might be interested.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#37

Post by tankbot » Wed, Oct 31, 2012, 5:02 AM UTC

jemfinch wrote: post #35

tankbot wrote: post #31

Looks like Disney fixed theirs. Can't believe there are admins at this level that miss this.

Why do you think Disney has access to high quality admins? Do you know high quality sysadmins who want to work for Disney, or companies like it? Just because a company is a big name doesn't mean it attracts big talent. Disney is still fishing from the same ocean where all the best engineers went to sexier places.

My comment was really 2 separate statements, I don't necessarily think Disney has a 'rock star' admin(s). But you make a valid point.

Also, I think I don't get paid enough.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#38

Post by benjaminRRR » Wed, Oct 31, 2012, 5:17 AM UTC

julianz wrote: post #36

notatoad wrote: post #26

Earlier quoted context omitted.

Why is that a big deal? Is exposing the public IPs of some random people really an issue?

It's not just that. You can get an idea of the traffic to the site if you watch for a while. When that information might be commercially sensitive then it could be a genuine issue. For example, nba.com has been averaging about 3 connections and 1021 idle workers while I've been watching it. That's perhaps less traffic than you might expect? I don't know, but if I were paying for ad space I might be interested.

Seems like a great way to test your DDOS toolset with real-world targets.

Re: Popular sites with Apache server-status enabled (leaking internal details)

#39

Post by soldermont001 » Wed, Oct 31, 2012, 6:12 AM UTC

tankbot wrote: post #31

Looks like Disney fixed theirs. Can't believe there are admins at this level that miss this.

Looks like they still have sites that are open though:

http://corporate.disney.go.com/server-status/

Re: Popular sites with Apache server-status enabled (leaking internal details)

#40

Post by pygorex » Wed, Oct 31, 2012, 8:08 AM UTC

Even a cursory scan of the http://urlfind.org/?server-status list reveals scads of porn sites exposing their visitor's IP addresses:

(Note these links go to Apache server-status pages at the time of linking. This may change if the server admins wise up - to be on the safe side consider them NSFW):

  http://black-tgirls.com/server-status
  http://badexgfs.com/server-status
  http://tubepornx.com/server-status
  http://lesbianvalley.net/server-status
  ..... and many more .....

Personally, I don't care what consenting adults do with their genitals. But I think it's safe to assume that the visitors to these sites expect a certain level of privacy that's not being met.