Repository navigation
Don't confirm Apache path traversal from an HTML passwd example - #49
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
CVE-2021-41773/42013 used _raw_http and treated any response containing "root:" plus "/bin/" as a retrieved /etc/passwd. A 404 docs page or SPA catch-all quoting a passwd snippet therefore pinned a CRITICAL finding. Require HTTP 200, reject HTML, and match a real passwd root line. Co-authored-by: dmitryflynn <dmitryflynn@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug and impact
probe_apache_path_traversalconfirmed CVE-2021-41773 / CVE-2021-42013 as CRITICAL whenever a raw HTTP response containedroot:plus/bin/(ornologin/daemon:). The probe uses_raw_http, which does not apply the SPA/CDN baseline filter used by_http_get, and it never checked the status line.Trigger: scan any site whose 404 or catch-all HTML quotes a Linux passwd example (security blogs, Linux tutorials, cheat sheets).
GET /cgi-bin/.%2e/.%2e/.%2e/.%2e/etc/passwdreturns that HTML; fusion pins the probe-confirmed CVE as un-droppable. Operators see a confirmed Apache 2.4.49 RCE on a host that is not vulnerable.Root cause
Confirmation searched the entire raw response (headers + body) for generic passwd tutorial tokens. HTTP 404 pages and HTML articles routinely include
root:x:0:0:root:/root:/bin/bash.Fix and validation
Require HTTP 200, reject HTML bodies, and match a real
/etc/passwdroot:<hash>:<uid>:<gid>:line in the body only. Shared helper covers both the single-encoded and double-encoded probes.Validation:
<pre>passwd snippet do not confirm; raw 200 passwd still confirms 41773 and 42013.python3 -m pytest test_probers.py test_fusion_engine_bridge.py test_ai_agent.py::test_cve_probe_apache_path_traversal_marker -q— 56 passed.