Apache – how do you exploit “Apache httpOnly cookie disclosure”

apachecookiesdisclosurehttponly

Vulnerability description
Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
how do you exploit "Apache httpOnly cookie disclosure"?

Best Answer

There are preconditions to exploiting this:

  1. The site uses default apache "Bad Request" (like 400 or 404) error pages
  2. The site is already vulnerable to Cross-Site Scripting (XSS)
  3. One of the vulnerable versions of Apache.

The XSS is used to

  1. build a malformed header
  2. use malformed header to make an XMLHttpRequest to a non-existent page
  3. The response from this XMLHttpRequest contains the cookie. This response is written to the page in a Javascript alert as a proof of concept in the exploits published, but in really exploiting it, the attacker would transmit this value back to themselves somehow (like with another request).

Here is an example of what the injected javascript would look like:

http://fd.the-wildcat.de/apache_e36a9cf46c.php

and here is another:

https://gist.github.com/1955a1c28324d4724b7b/7fe51f2a66c1d4a40a736540b3ad3fde02b7fb08

Related Topic