支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: 0871a6b0f5c6f0b0a775f42ac0f6b4d5ee69665a

来源
https://github.com/tbachvarova/linux-apache-fix-mod_rewrite-spaceInURL
关联漏洞
标题:Apache HTTP Server 环境问题漏洞 (CVE-2023-25690)
Description:Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 2.4.0版本至2.4.55版本存在环境问题漏洞，该漏洞源于某些mod_proxy配置允许HTTP请求走私攻击。攻击者利用该漏洞可以绕过代理服务器中的访问控制。
Description
Fix URL containing SPACES after Apache upgrade  CVE-2023-25690
介绍
# FIX linux (Ubuntu) Apache mod_rewrite space In URL

After the last Apache Upgrade, I've had some issues with "spaces in URL" in mod_rewrite.
2023-04-25 - upgrade apache2:amd64 2.4.38-3+deb10u9 2.4.38-3+deb10u10

The URLs that contain "space" and have been replaced with **%20** start to return error 403 by Apache.

I found that the update was actually to fix this:
https://github.com/apache/httpd/commit/d78a166fedd9d02c23e4b71d5f53bd9b2c4b9a51

(https://security-tracker.debian.org/tracker/CVE-2023-25690 )

After the last Apache upgrade under Ubuntu, I solve the problem of returning 403 by adding `[NC,L,B,BNP]` at the end of the domain conf file, adn it works for me.

>RewriteEngine On
> 
>RewriteBase /
> 
>RewriteRule ^([^/])/([^/])$ /index.php?lang=$1&page=$2 [NC,L,**B,BNP**]


![fix Apache space in URL - mod_rewrite](img.jpg)


I hope that this fix should be helpful to somebody :-)
文件快照

 [4.0K]  /data/pocs/0871a6b0f5c6f0b0a775f42ac0f6b4d5ee69665a
├── [372K]  img.jpg
└── [ 896]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。