Apache developers scramble to fix proxy flaw
Admins, nail down your systems
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Apache developers are working on a fix of a flaw in its web server software that creates a possible mechanism to access internal systems.
The zero-day vulnerability only rears its ugly head if reverse proxy rules are configured incorrectly and is far from easy to exploit ... but it is nonetheless nasty. A possible patch for the vulnerability was suggested by an Apache developer from Red Hat on Wednesday but has yet to be fully tested. In the meantime, web admins would be well advised to nail down their systems.
The as-yet-unpatched bug was discovered by Prutha Parikh, a security researcher at Qualys, who came across it while in the process of researching another reverse proxy issue.
Parikh has published a detailed explanation of the flaw – alongside proof of concept code – in a post on the Qualys blog here. ®
COMMENTS
Stupid?
I'd say, that anyone that puts "RewriteRule ^(.*) http://10.40.2.159$1" together with "ProxyPassMatch ^(.*) http://10.40.2.159$1" in their httpd.conf is responsible for their own stupidity...
@condiment
What part of the article did you not read:
1. "This only applies to apache servers that are being used as a reverse proxy" - yep that is explained clearly in the article.
2. Though not described in the article, there is no need to because it is adequately explained in the link to the Qualys site. Why re-hash, in fact there is nothing in the article to be "wrong" about.
3. Oh aye, big man speak. Come on then, put your money where your mouth is and show us your skillz and pwning.
Sigh,
Stupid in a hurry...
It's also very easy to make stupid config mistakes when in a hurry, especially where the box in question isn't planned (at the time) to be a production box.
Now who here can honestly say they've never done something stupid in a config?
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
