I am going through the Burpsuite Academy Training on Access Control and I came across a section I still don't fully understand. In their reading, they explain:
Some application frameworks support various non-standard HTTP headers that can be used to override the URL in the original request, such as
X-Rewrite-URL. If a web site uses rigorous front-end controls to restrict access based on URL, but the application allows the URL to be overridden via a request header, then it might be possible to bypass the access controls using a request like the following:
POST / HTTP/1.1 X-Original-URL: /admin/deleteUser
In the following lab you could modify the HTTP request so that you can access a restricted /admin page by changing the header to set the GET request to "/" and then adding
X-Original-URL: /admin as a new line.
I can't find any documentation on either of these two headers. What do they do? And why does this vulnerability work? Is this a niche exploit, or something that might existing on many servers?