Apache developers scramble to fix proxy flaw
Admins, nail down your systems
Apache developers are working on a fix of a flaw in its web server software that creates a possible mechanism to access internal systems.
The zero-day vulnerability only rears its ugly head if reverse proxy rules are configured incorrectly and is far from easy to exploit ... but it is nonetheless nasty. A possible patch for the vulnerability was suggested by an Apache developer from Red Hat on Wednesday but has yet to be fully tested. In the meantime, web admins would be well advised to nail down their systems.
The as-yet-unpatched bug was discovered by Prutha Parikh, a security researcher at Qualys, who came across it while in the process of researching another reverse proxy issue.
Parikh has published a detailed explanation of the flaw – alongside proof of concept code – in a post on the Qualys blog here. ®
I'd say, that anyone that puts "RewriteRule ^(.*) http://10.40.2.159$1" together with "ProxyPassMatch ^(.*) http://10.40.2.159$1" in their httpd.conf is responsible for their own stupidity...
What part of the article did you not read:
1. "This only applies to apache servers that are being used as a reverse proxy" - yep that is explained clearly in the article.
2. Though not described in the article, there is no need to because it is adequately explained in the link to the Qualys site. Why re-hash, in fact there is nothing in the article to be "wrong" about.
3. Oh aye, big man speak. Come on then, put your money where your mouth is and show us your skillz and pwning.
Stupid in a hurry...
It's also very easy to make stupid config mistakes when in a hurry, especially where the box in question isn't planned (at the time) to be a production box.
Now who here can honestly say they've never done something stupid in a config?