Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of jorton@redhat.com designates
 209.132.183.28 as permitted sender)
Date: Fri, 8 Jun 2012 09:37:56 +0100
From: Joe Orton <jorton@redhat.com>
To: dev@httpd.apache.org
Subject: Re: post-CVE-2011-4317 (rewrite proxy unintended interpolation)
 rewrite PR's
Message-ID: <20120608083756.GA20711@redhat.com>
Mail-Followup-To: dev@httpd.apache.org
References: 
 <CALK=YjMTaLgin1NNKf_4ym0L1mFvifE9Ski6OanxxAT5RBRAww@mail.gmail.com>
 <4FC0D859.3010101@kippdata.de>
 <CAKUrXK7BkR1UOUafBaD3nK7SvN6+VkgNNfCPiii4drVfQZNAsg@mail.gmail.com>
 <20120607155510.GA27883@redhat.com>
 <CAKUrXK4GhZ_b-oRz3r6UwfyqKruT_5MOPs+wexSxtkWWJV61BQ@mail.gmail.com>
 <CALK=YjON+y8RFHEM5nqKytjCsgZmkkmYoOon3Ff0-T62S+cGuw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: 
 <CALK=YjON+y8RFHEM5nqKytjCsgZmkkmYoOon3Ff0-T62S+cGuw@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Organization: Registered in England and Wales under Company Registration No.
 03798903
  Directors: Michael Cunningham (USA), Mark Hegarty (Ireland),
 Matt Parson (USA), Charlie Peters (USA)

On Thu, Jun 07, 2012 at 01:23:29PM -0400, Eric Covener wrote:
> e.g. RewriteOptions +"I know I'm running this regex against something
> that's not guaranteed to look like a URL-path, and I'll write a regex
> that carefully matches/captures the input"

How about this?  I'm not sure how to put the right level of fear into 
the name.  AllowUnsafeURI?  AllowInsecureURIMatch?

(This patch works for the CONNECT rewriting case, I haven't tested the 
other problematic cases.)

Index: modules/mappers/mod_rewrite.c
===================================================================
--- modules/mappers/mod_rewrite.c	(revision 1347667)
+++ modules/mappers/mod_rewrite.c	(working copy)
@@ -190,6 +190,7 @@
 #define OPTION_INHERIT              1<<1
 #define OPTION_INHERIT_BEFORE       1<<2
 #define OPTION_NOSLASH              1<<3
+#define OPTION_ANYURI               1<<4
 
 #ifndef RAND_MAX
 #define RAND_MAX 32767
@@ -2895,6 +2896,9 @@
                          "LimitInternalRecursion directive and will be "
                          "ignored.");
         }
+        else if (!strcasecmp(w, "allowanyuri")) {
+            options |= OPTION_ANYURI;
+        }
         else {
             return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '",
                                w, "'", NULL);
@@ -4443,8 +4447,14 @@
         return DECLINED;
     }
 
-    if ((r->unparsed_uri[0] == '*' && r->unparsed_uri[1] == '\0')
-        || !r->uri || r->uri[0] != '/') {
+    /* Unless the anyuri option is set, ensure that the input to the
+     * first rule really is a URL-path, avoiding security issues with
+     * poorly configured rules.  See CVE-2011-3368, CVE-2011-4317. */
+    if ((dconf->options & OPTION_ANYURI) == 0
+        && ((r->unparsed_uri[0] == '*' && r->unparsed_uri[1] == '\0')
+            || !r->uri || r->uri[0] != '/')) {
+        rewritelog((r, 8, NULL, "Declining, request-URI '%s' is not a URL-path",
+                    r->uri));
         return DECLINED;
     }
 
Index: docs/manual/mod/mod_rewrite.xml
===================================================================
--- docs/manual/mod/mod_rewrite.xml	(revision 1347667)
+++ docs/manual/mod/mod_rewrite.xml	(working copy)
@@ -188,6 +188,37 @@
       later.</p>
       </dd>
 
+      <dt><code>AllowAnyURI</code></dt>
+      <dd>
+
+      <p>When <directive module="mod_rewrite">RewriteRule</directive>
+      is used in <code>VirtualHost</code> or server context with
+      version 2.2.22 or later of httpd, <module>mod_rewrite</module>
+      will only process the rewrite rules if the request URI is a <a
+      href="./directive-dict.html#Syntax">URL-path</a>.  This avoids
+      some security issues where particular rules could allow
+      "surprising" pattern expansions (see <a
+      href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3368">CVE-2011-3368</a>
+      and <a
+      href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4317">CVE-2011-4317</a>).
+      To lift the restriction on matching a URL-path, the
+      <code>AllowAnyURI</code> option can be enabled, and
+      <module>mod_rewrite</module> will apply the rule set to any
+      request URI string, regardless of whether that string matches
+      the URL-path grammar required by the HTTP specification.</p>
+
+      <note type="warning">
+      <title>Security Warning</title> 
+
+      <p>Enabling this option will make the server vulnerable to
+      security issues if used with rewrite rules which are not
+      carefully authored.  It is <strong>strongly recommended</strong>
+      that this option is not used.  In particularly, beware of input
+      strings containing the '<code>@</code>' character which could
+      change the interpretation of the transformed URI.</p>
+      </note>
+      </dd>
+
       </dl>
 
 </usage>