Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I set up Apache with mod_wsgi in a default installation, with a very simple test application test.wsgi that goes like this:

def application(environ, start_response):
    status = '200 OK'
    output = 'Path: %s' % environ['PATH_INFO']
    response_headers = [('Content-type', 'text/plain'),
                        ('Content-Length', str(len(output)))]
    start_response(status, response_headers)
    return [output]

Apache itself is basically configured like that:

WSGIScriptAlias / /home/user/wsgi_test/test.wsgi

Now if I access URLs on that server, I get the following output:

  • GET /test/../test/./test => Path: /test/test
  • GET /test/%2E%2E/abc => Path: /abc
  • GET /test%2fabc => 404 Not found (due to AllowEncodedSlashes off, I suppose)

Thus it looks to me that Apache resolves/pre-processes these URLs before passing them to the application, which is nice because it can prevent a lot of local file inclusion and directory traversal attacks where the file path is not part of the query string.

Can one rely on this behaviour or is there some nasty way to trick Apache into actually passing a URL like /test/foo/../bar to the application? Would it be an Apache bug if that was possible?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

The security guideline "Defense in Depth" suggests that you should configure Apache to preprocess paths, but you should also protect against dangerous paths yourself.

Since you probably know a lot more about what the valid paths should look like, you should be able to come up with a lot more restrictive test that's also easier to get right than anything Apache can do in general.

share|improve this answer
    
Can you give details on how much you can expect from Apache here? Especially on how this path preprocessing could possibly be circumvented? –  Niklas B. Feb 20 '12 at 0:22
    
@Niklas: It's not defense in depth if you are relying on Apache's preprocessing step at all. Assume the remote attacker has complete control over the string you receive. –  Ben Voigt Feb 20 '12 at 0:22
    
I don't want to question the fact that multiple layers of defense are better than a single one (rather to the contrary). But as a penetration tester, I am also interested in how mistakes like trusting Apache to properly sanitize URLs could be exploited. –  Niklas B. Feb 20 '12 at 0:25
    
@Niklas: Are you testing apache, or the custom code? –  Ben Voigt Feb 20 '12 at 0:27
    
The custom code. I take it that it would take an Apache bug to make a situation like this exploitable, where a script uses a file path retrieved from the URL. But I am not completely sure. –  Niklas B. Feb 20 '12 at 0:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.