Re: CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Mar 10, 2023 at 8:56 AM Thomas Åkesson
<thomas.akesson@xxxxxxxxxxxx> wrote:
>
> Hi,
>
> We are experiencing the effect that a RewriteRule resulting in R (redirect) are blocked (403) with AH10410 despite being encoded before 2.4.56 (the resulting Location header was ok). Is this change intentional?
>
> Example:
> RewriteRule             ^/here/([^/]+)(/.*)$    http://example.com:8080/elsewhere/?base=$1&target=$2 [R,QSA,L]
>
> We are evaluating this workaround:
> [R,B,BNP,NE,QSA,L]
>
> This results in encoded slashes which is not necessary. Any ideas how to achieve the previous result?

You can limit the characters B will escape.  I assume spaces in the
URL are the original problem?
Try e.g. [R,B= ?,...]

The question mark is to avoid the issue of not being able to have " "
as the final character in this syntax.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx





[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux