1

We recently had a vulnerability scan that returned an information disclosure that I've never heard about before. The scanning company provided this information.

Our researcher used an open source tool called BurpSuite to intercept an HTTP request to the vulnerable URL. He then used BurpSuite to repeat that same request, but modified the GET parameter to "GET http://localhost:22/ HTTP/1.1". The server then returned the response "HTTP/1.1 200 OK". This means that the server is allowing external traffic to route to internal resources and that port 22 is open internally for SSH access. An attacker could use this information to launch an attack to attempt to gain SSH access to the server.

I also confirmed that this behavior is unintended as port 22 has a device filtering traffic from external sources (screenshot below).

I am having problems interpreting the results and I'm not sure this isn't a completely bogus finding. The company does not have a suggested fix for the vulnerability.

The web server in question is running CentOS 7.9 with Apache 2.4.6. The server is behind a company firewall with only ports 80 and 443 exposed to the outside world.

Questions. Is this finding legitimate? If so, how do I remediate? Thanks.

In answer to one comment, yes apache is being used to proxy to a tomcat instance on the same server. ProxyPass and ProxyPassReverse are defined for specific URLs but not for the general /.

Second comment - I am in a department within a large US government agency. I don't have any say on what scanning companies are contracted with.

4
  • 1
    The text you quote has no sense. Following statement "The server then returned the response" means that the request was sent from a host different from the server. But the request to localhost means the tester has executed request on the testers own host and that the request was not sent to the server. The tester tested the testers own host, not your server.
    – mentallurg
    Jan 21 at 1:51
  • I totally agree with @mentallurg statement. I'd like to add that it may be time to look for a more professional security consultant.
    – Jeroen
    Jan 21 at 2:09
  • Is the server in question a proxy server?
    – hft
    Jan 21 at 2:44
  • 1
    If so, maybe they are saying the proxy is forwarding the absolute URI in the GET request along to something that apparently is running on port 22. It doesn't have to be localhost on the tester's computer since the "localhost" is in the body of the GET request that goes to the proxy server (if it is a proxy server).
    – hft
    Jan 21 at 2:46

1 Answer 1

1

The information might indicate an unintended externally triggered access to resources which should not be accessible from outside. This would be the case if the web server is configured to interpret the request as a HTTP proxy request and thus attempts to connect to localhost port 22 - where localhost is the same host as the server itself. But it might also be the case that the server or web application interprets the request not as proxy request or ignores the host:domain part of the request.

It should be easy to find out what is the case: create a similar request and check with a packet capture (tcpdump) if a connection to localhost port 22 is actually created. If not check log files and actual HTTP response to find out how the request is really interpreted. Even if access to port 22 was triggered the risk should be low regarding port 22 since HTTP and SSH are different protocols which cannot interact with each other.

But if the report is correct it might indicate a larger risk of SSRF. With SSRF a publicly accessible internal web server (as in your case) can be tricked into making requests to internal web servers (and sometimes also other servers), which might result in information leaks but also other attacks against the internal servers. Therefore make sure that your web server cannot be used with HTTP proxy requests (full URL in request line instead of only path) to connect to internal systems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.