0

If I have a website where a user can add any string into the URL after the domain and have it return a 200 status code rather than 404, what are the security implications?

Is this something that can be exploited by hackers?

3
  • Maybe the "prove you own the domain by serving this file from your webhost" could go badly, if the party doing the verification doesn't check the file content, only that it exists. For example, many certificate authorities rely on this sort of validation.
    – Ben Voigt
    Jan 13, 2023 at 17:26
  • 1
    @BenVoigt Failing to both use cryptographically random unique tokens per domain and then verify the file contents would be a disastrously bad security flaw, one that would almost certainly disqualify the CA from general trust on the grounds that it will issue certificates without performing even domain validation. With that said, possibly some CA out there is that stupid and somebody trusts it anyhow.
    – CBHacking
    Jan 13, 2023 at 18:21
  • @CBHacking: What if it is the filename (path component of the URI) that is cryptographically random rather than the file contents? Then the CA could make an argument that they performed a strong test, even ignoring file contents. It's not the design I would use, but I also wouldn't bet that it is disqualifying.
    – Ben Voigt
    Jan 13, 2023 at 19:14

1 Answer 1

1

In general, no; it's a bad design but not in a directly insecure way. However, it is going to generate a LOT of headaches down the road for you, if you (or any future customers/partners) use automated security scanners. Violating the standard regarding HTTP response codes means that scanners which look for the expected codes will (falsely) report a ton of issues, such as that your server is exposing every web application framework's config files, log files, cross-user data access, and so on. Such a flood of false positives will be annoying to deal with directly, and also make it much more likely that you'll miss any true positives (which would be very bad if you're ever attacked by anything smarter than a basic automated scanner; the vuln there would be the exposed file not the 200-for-everything, but the 200-for-everything would make it harder to notice the exposed file).

It would definitely pose a problem for you in the (highly unlikely) case that any CA or other trusted service attempts to verify your site's ownership by asking the owner to place a file at a specific location and then checking that location for the file, without verifying the file contents (response body). Such an insecure check would represent a huge vulnerability in the trusted service, but your site's non-standards-compliant behavior would make it possible for you to be a victim of their vulnerability.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .