Unpatched Apache reverse proxy flaw allows access to internal network
- 26 November, 2011 00:43
A yet-to-be-patched flaw discovered in the Apache HTTP server allows attackers to access protected resources on the internal network if some rewrite rules are not defined properly.
The vulnerability affects Apache installations that operate in reverse proxy mode, a type of configuration used for load balancing, caching and other operations that involve the distribution of resources over multiple servers.
In order to set up Apache HTTPD to run as a reverse proxy, server administrators use specialized modules like mod_proxy and mod_rewrite.
Security researchers from Qualys warn that if certain rules are not configured correctly, attackers can trick servers into performing unauthorized requests to access internal resources.
The problem isn't new and a vulnerability that allowed similar attacks was addressed back in October. However, while reviewing the patch for it, Qualys researcher Prutha Parikh realized that it can be bypassed due to a bug in the procedure for URI (Uniform Resource Identifier) scheme stripping. The scheme is the URI part that comes before the colon ":" character, such as http, ftp or file.
One relatively common rewrite and proxying rule is "^(.*) http://internal_host$1", which redirects the request to the machine internal_host. However, if this is used and the server receives, for example, a request for "host::port" (with two colons), the "host:" part is stripped and the rest is appended to http://internal_host in order to forward it internally.
The problem is that in this case, the remaining part is ":port", therefore transforming the forwarded request into http://internal_host:port, an unintended behavior that can result in the exposure of a protected resource.
In order to mitigate the problem server administrators should add a forward slash before $1 in the rewrite rule, the correct form being "^(.*) http://internal_host/$1", Parikh said.
The Apache developers are aware of the problem and are currently discussing the best method of fixing it. One possibility would be to strengthen the previous patch in the server code in order to reject such requests, however, there's no certainty that other bypass methods won't be discovered.
"We could try improve that fix, but I think it would be simpler to change the translate_name hooks in mod_proxy and mod_rewrite to enforce the requirement in the 'right' place," said Red Hat senior software engineer Joe Orton on the Apache dev mailing list. Orton proposed a patch that is currently being reviewed by the other developers.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
CIOs to Become In-House Brokers -- and That's a Good Thing
The future of computing
10 Hot Hadoop Startups to Watch
The future of computing
How to Switch From iPhone 5S to BlackBerry Z30 (and Why)
Top 20 Critical Security Controls - Compliance Guide
Simply being compliant is not enough to mitigate attacks and protect critical information. Organizations can reduce chances of compromise by shifting away from a compliance-driven approach. This guide provides the Top 20 Critical Security Controls (CSCs) developed by the SANS Institute to address the need for a risk-based approach to security.
Converged Infrastructure Systems Comparative Assessment
The powers of virtualization and cloud computing have been central to innovation. Data centres have achieved a level of unparalleled utility and functionality – but at the same time creating unprecedented complexity and financial burden. Read how a proper converged infrastructure solution can change the status quo.
Software Defined Protection - The Enterprise Security Blueprint
In a world with high-demanding IT infrastructures and networks, where perimeters are no longer well defined and where threats grow more intelligent every day, we need to define the right way to protect enterprises in the ever-changing threat landscape. Download today to define your security blueprint.