Top 10 winner

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!

Orange Tsai · Orange Tsai · 8 August 2024

Apache's modules share one request_rec and read its fields differently. mod_rewrite treats r->filename as a URL and truncates at an encoded ?, so <Files admin.php> auth falls to admin.php%3Fooo.php, which PHP-FPM splits back; every RewriteRule also tries its substitution without DocumentRoot, opening the filesystem and local gadgets; and ap_invoke_handler still maps Content-Type onto a handler, so a CGI Location redirect with an injected header reaches mod_proxy, unix sockets and RCE.

Record

Researcher

Orange Tsai

Published by

Orange Tsai

Date

8 August 2024

In the archive

• Ranked #1 in the 2024 Top 10 Web Hacking Techniques

Related sources

• Black Hat USA 2024 briefing
• HITCON 2024 presentation
• Earlier ModSecurity double-response report
• PHP LFI-to-RCE gadget explanation
• Talk recording
• Talk recording
• Talk recording

Tags

• parser-differential
• auth-bypass
• rce
• ssrf
• header-injection
• path-traversal
• lfi
• php
• cve
• owasp-a01-2021
• owasp-a03-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Orange Tsai, first published at the original source. Preserved copies are kept so the citation survives its host.