From 3371c662632f499a390317ec46f35abd7bb1f066 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 5 Oct 2011 14:24:44 +0000 Subject: [PATCH] SECURITY (CVE-2011-3368): Prevent unintended pattern expansion in some reverse proxy configurations by strictly validating the request-URI: * server/protocol.c (read_request_line): Send a 400 response if the request-URI does not match the grammar from RFC 2616. This ensures the input string for RewriteRule et al really is an absolute path. Reviewed by: rpluem, wrowe, covener, fielding git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1179239 13f79535-47bb-0310-9956-ffa450edef68 --- server/protocol.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/server/protocol.c b/server/protocol.c index 896a8fd603..995ee50019 100644 --- a/server/protocol.c +++ b/server/protocol.c @@ -655,6 +655,25 @@ static int read_request_line(request_rec *r, apr_bucket_brigade *bb) ap_parse_uri(r, uri); + /* RFC 2616: + * Request-URI = "*" | absoluteURI | abs_path | authority + * + * authority is a special case for CONNECT. If the request is not + * using CONNECT, and the parsed URI does not have scheme, and + * it does not begin with '/', and it is not '*', then, fail + * and give a 400 response. */ + if (r->method_number != M_CONNECT + && !r->parsed_uri.scheme + && uri[0] != '/' + && !(uri[0] == '*' && uri[1] == '\0')) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, + "invalid request-URI %s", uri); + r->args = NULL; + r->hostname = NULL; + r->status = HTTP_BAD_REQUEST; + r->uri = apr_pstrdup(r->pool, uri); + } + if (ll[0]) { r->assbackwards = 0; pro = ll; -- 2.40.0