Commit 318b8675 authored by Joe Orton's avatar Joe Orton
Browse files

Fix for additional cases of URL rewriting with ProxyPassMatch or 

RewriteRule, where particular request-URIs could result in undesired
backend network exposure in some configurations. (CVE-2011-4317)

Thanks to Prutha Parikh from Qualys for reporting this issue.

* modules/proxy/mod_proxy.c (proxy_trans): Decline to handle the "*"
  request-URI.  Fail for cases where r->uri does not begin with a "/".

* modules/mappers/mod_rewrite.c (hook_uri2file): Likewise.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1209432 13f79535-47bb-0310-9956-ffa450edef68
parent f3d438af

modules/mappers/mod_rewrite.c

+12 −0
Changes for modules/mappers/mod_rewrite.c: 12 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -4419,6 +4419,18 @@ static int hook_uri2file(request_rec *r) 
        return DECLINED;

    }



    if (strcmp(r->unparsed_uri, "*") == 0) {

        /* Don't apply rewrite rules to "*". */

        return DECLINED;

    }



    /* Check that the URI is valid. */

    if (!r->uri || r->uri[0] != '/') {

        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

                     "Invalid URI in request %s", r->the_request);

        return HTTP_BAD_REQUEST;

    }

    

    /*

     *  add the SCRIPT_URL variable to the env. this is a bit complicated

     *  due to the fact that apache uses subrequests and internal redirects

modules/proxy/mod_proxy.c

+12 −0
Changes for modules/proxy/mod_proxy.c: 12 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -655,6 +655,18 @@ static int proxy_trans(request_rec *r) 
        return OK;

    }



    if (strcmp(r->unparsed_uri, "*") == 0) {

        /* "*" cannot be proxied. */

        return DECLINED;

    }



    /* Check that the URI is valid. */

    if (!r->uri || r->uri[0] != '/') {

        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

                     "Invalid URI in request %s", r->the_request);

        return HTTP_BAD_REQUEST;

    }



    /* XXX: since r->uri has been manipulated already we're not really

     * compliant with RFC1945 at this point.  But this probably isn't

     * an issue because this is a hybrid proxy/origin server.