Re: CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



>>>> Try e.g. [R,B= ?,...]
>>>> 
>>>> The question mark is to avoid the issue of not being able to have " "
>>>> as the final character in this syntax.
>>> 
>> 
>> Sorry, the above doesn't work. Someone reported in another thread: [R,B=\ ]
> 
> The real trick seems to be quoting the entirety of the flags, then
> finding any 2nd character to escape.
> RewriteRule ... "[B= ?]"

Thanks for pointing that out. Quoting the entirety of the flags works. Would be great to get that into the documentation.

https://httpd.apache.org/docs/2.4/rewrite/flags.html#flag_b


>> Thanks for the suggestion. I am unable to make 2.4.52 (Ubuntu) accept space for the B-flag. I have tried first, middle, last, only flag but always getting "RewriteRule: bad flag delimiters".
>> 
>> I am also having concerns whether this would work (unable to test at this time).
>> - The spaces would likely be double-encoded unless adding NE
> 
> In your case, with just B you'd end up with space->+ and the default
> escaping w/o NE does not touch a +.

After some additional experiments I was leaning towards "[R,B= +,...]" since a plus character would otherwise be confused with space (was actually a bug before when using [R, ...]). 

However, the plus character will then be double escaped into %252b. Sigh. 


>> - Adding NE would suppress encoding of all other characters that should be encoded in the query string
> 
> A colleague proposed a fix to this scenario, where the new check could
> be omitted if redirecting and escaping.

That would be great in order to maintain the historical behavior and keep a simpler syntax (but the plus character is still a challenge).


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx





[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux