[HN Gopher] Confusion Attacks: Exploiting Hidden Semantic Ambigu...
       ___________________________________________________________________
        
       Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache
       HTTP Server
        
       Author : tptacek
       Score  : 83 points
       Date   : 2024-08-09 05:47 UTC (4 days ago)
        
 (HTM) web link (blog.orange.tw)
 (TXT) w3m dump (blog.orange.tw)
        
       | tptacek wrote:
       | These are pretty beautiful attacks, which build off what I think
       | are two basic issues Apache deals with that other webservers
       | don't:
       | 
       | * A maybe ill-advised architecture where lots of independently-
       | developed modules cooperate to handle a request, all working on
       | an over-complicated under-specified request "object".
       | 
       | * The requirement to honor `httpd.conf` file structures dating
       | back to the 1990s, which has led to legacy support code paths
       | that do surprising things.
       | 
       | The core of this article is a two-step attack that exploits (1)
       | the fact that modules alternately interpret `request->filename`
       | as a filename _and_ as a URL, which allows attackers to truncate
       | URLs at path separator characters, which by itself can slip you
       | past some basic ACLs, and (2) the fact that Apache will try to
       | serve request both with and without the `DocumentRoot` applied,
       | which, combined with the first attack pattern, means that config
       | directives that have attacker-controlled targets give attackers
       | full filesystem access. Hilarity ensues.
       | 
       | There's a really slick attack here that takes you from CRLF-
       | injection to SSRF and RCE, which is neat, because CRLF-injection
       | ("header splitting") would ordinarily not be that interesting of
       | an attack.
       | 
       | This is great stuff that just makes me wish more people ran
       | Apache in 2024.
        
         | Vecr wrote:
         | Why would you want more people to run Apache? If you're running
         | it you should cover it up with some sort of carefully
         | configured reverse proxy.
        
           | tptacek wrote:
           | So that I could play with bugs like these!
        
           | wepple wrote:
           | "Carefully" is very load bearing.
           | 
           | A similar but different class of issues common to web stacks
           | is when you have proxies and multiple layers of HTTP
           | "things", especially when they parse data differently (eg:
           | nginx fronting Apache)
        
           | chrsig wrote:
           | Because I wasn't hurting enough without having to worry about
           | parser alignment.
        
       | tommiegannert wrote:
       | So my public web servers will start seeing a lot more spam
       | requests that contain %0D%0A or end in %3F?
       | 
       | Really impressive to find that many exploitable issues without
       | once relying on a buffer overflow.
        
       | xg15 wrote:
       | The lesson I've learned from this: Ambiguity may not always
       | resolve. If some technical details in a spec seem confusing or
       | ambiguous between two contradictory options, then half of the
       | implementations will probably do option #1, the other will half
       | will do option #2 and some may do both at the same time.
        
       | flemhans wrote:
       | The AddHandler stuff I've seen exploited or attempted in the last
       | 10 years
        
       ___________________________________________________________________
       (page generated 2024-08-13 23:00 UTC)