3

I am going through the Burpsuite Academy Training on Access Control and I came across a section I still don't fully understand. In their reading, they explain:

Some application frameworks support various non-standard HTTP headers that can be used to override the URL in the original request, such as X-Original-URL and X-Rewrite-URL. If a web site uses rigorous front-end controls to restrict access based on URL, but the application allows the URL to be overridden via a request header, then it might be possible to bypass the access controls using a request like the following:

POST / HTTP/1.1 X-Original-URL: /admin/deleteUser

In the following lab you could modify the HTTP request so that you can access a restricted /admin page by changing the header to set the GET request to "/" and then adding X-Original-URL: /admin as a new line.

I can't find any documentation on either of these two headers. What do they do? And why does this vulnerability work? Is this a niche exploit, or something that might existing on many servers?

Improve this question
3
  • 2
    they are made-up headers. how they are used and how they can be abused will depend on the particular application that implements them, not any standard behavior on standard headers that many tools understand.
    – dandavis
    Apr 16, 2020 at 18:14
  • So wait--those headers listed are totally made-up? The readings claim they are 'non-standard' not that they are totally arbitrary. So is the vulnerability just that you are crafting a random header with a URL to see if it processes it as a request?
    – Tobin Shields
    Apr 16, 2020 at 22:58
  • 2
    bingo. x-anything is typically used for custom headers, some might have a defacto following, but certainly nothing in the spec.
    – dandavis
    Apr 16, 2020 at 23:02

1 Answer 1

Reset to default
2

As mentioned in the comments, these are custom headers in some PHP frameworks.

Many web frameworks such as Symfony 2.7.0 to 2.7.48, 2.8.0 to 2.8.43, 3.3.0 to 3.3.17, 3.4.0 to 3.4.13, 4.0.0 to 4.0.13 and 4.1.0 to 4.1.2 , zend-diactoros up to 1.8.4, zend-http up to 2.8.1, zend-feed up to 2.10.3 are affected by this security issue.

Fun fact: This was reported by Albino Wax https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers

https://www.acunetix.com/vulnerabilities/web/url-rewrite-vulnerability/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .