Apache Mod ReWrite Rules Bypassing Image Linking Vulnerability
BID:3176
Info
Apache Mod ReWrite Rules Bypassing Image Linking Vulnerability
| Bugtraq ID: | 3176 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 12 2001 12:00AM |
| Updated: | Aug 12 2001 12:00AM |
| Credit: | This vulnerability was discovered by Jeff Workman <[email protected]>, and announced to the Bugtraq mailing list on August 12, 2001. |
| Vulnerable: |
IBM HTTP Server 1.3.19 Apache Apache 1.3.20 Apache Apache 1.3.19 Apache Apache 1.3.17 Apache Apache 1.3.14 |
| Not Vulnerable: | |
Discussion
Apache Mod ReWrite Rules Bypassing Image Linking Vulnerability
Apache is a freely available, widely used web server distributed and maintained by the Apache Server Project.
It is possible to bypass mod_rewrite rules if the rules are constructed in a certain way, such as:
RewriteCond %{HTTP_REFERER} !^http://www\.yoursite\.com.*$
RewriteRule ^/images/.* - [G]
This does not filter requests for the //images directory, and could allow a remote site to link images, resulting in increased hosting costs, and potentially a denial of service.
Apache is a freely available, widely used web server distributed and maintained by the Apache Server Project.
It is possible to bypass mod_rewrite rules if the rules are constructed in a certain way, such as:
RewriteCond %{HTTP_REFERER} !^http://www\.yoursite\.com.*$
RewriteRule ^/images/.* - [G]
This does not filter requests for the //images directory, and could allow a remote site to link images, resulting in increased hosting costs, and potentially a denial of service.
Exploit / POC
Apache Mod ReWrite Rules Bypassing Image Linking Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Apache Mod ReWrite Rules Bypassing Image Linking Vulnerability
Solution:
Use of the following rule design is recommended:
RewriteCond %{HTTP_REFERER} !^http://www\.yoursite\.com$
RewriteRule ^/*images/*.* - [G]
Apple has released Mac OS X Web Sharing Update 1.0 which addresses this issue for Mac users.
Apache Apache 1.3.19
Solution:
Use of the following rule design is recommended:
RewriteCond %{HTTP_REFERER} !^http://www\.yoursite\.com$
RewriteRule ^/*images/*.* - [G]
Apple has released Mac OS X Web Sharing Update 1.0 which addresses this issue for Mac users.
Apache Apache 1.3.19