Top 10 winner
Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
Apache's modules share one request_rec and read its fields differently. mod_rewrite treats r->filename as a URL and truncates at an encoded ?, so <Files admin.php> auth falls to admin.php%3Fooo.php, which PHP-FPM splits back; every RewriteRule also tries its substitution without DocumentRoot, opening the filesystem and local gadgets; and ap_invoke_handler still maps Content-Type onto a handler, so a CGI Location redirect with an injected header reaches mod_proxy, unix sockets and RCE.
Record
- Researcher
- Orange Tsai
- Published by
- Orange Tsai
- Date
- Topic
- HTTP
In the archive
Related sources
- Black Hat USA 2024 briefing
- HITCON 2024 presentation
- Earlier ModSecurity double-response report
- PHP LFI-to-RCE gadget explanation
- Confusion Attacks: Exploiting Hidden Semantic Ambiguity In Apache HTTP Server! - Orange Tsai
- Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
- #Hacktivity2024 // Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
Tags
This page is the archive's own catalogue record. The research is the work of Orange Tsai, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .