2

When a special query value is typed in the URL, apache sends back a 302 redirect to root url (/).

We're using CPanel and we owns the server. The apache virtualhost file wasn't touched and is managed by CPanel. I tried to do some researches but when I type "redirect" or "302" with my issue, I get answers about "how to url-rewrite".

The problem appears when using chevrons and maybe other special characters. Here are the tested queries (on my server, on a test subdomain, no .htaccess involved, script echoes $_GET): http://dev.rihan.fr/echo.php

  • ?foo=%3c (ie. ?foo=<) (OK)
  • ?foo=%3e (ie. ?foo=>) (OK)
  • ?foo=%3c%3c (ie. ?foo=<<) (KO)
  • ?foo=%3e%3e (ie. ?foo=>>) (KO)
  • ?foo=%3d%3c (ie. ?foo==<) (OK)
  • ?foo=%3c%3d (ie. ?foo=<=) (KO)

We're on Apache 2.4.18, PHP 5.6.20.

Any idea on whether it's a known bug or a particular configuration? Thanks for your help.

  • You state you are using Apache, however, the redirect response is coming from an nginx server? – MrWhite Jul 5 '16 at 23:54
  • 1
    Actually, nginx acts as a front-end server, calling Apache under the hood. I've made my checks with nginx disabled, you can still access Apache directly using :8888 port – Max13 Jul 6 '16 at 0:33
2

It sounds like a security feature on the server is redirecting the connection when html escaped data is added to the URL. Take a look through your Apache configuration files and the vhost files and check any redirect rules you find, you will probably fine one has a regex pattern for identifying html escaped data and blocking it as a security precaution. If you don't want to go through all the configuration files you could try base64_encoding the escaped values which are causing the problems, I have done this before where a server was configured to block html escaped data in the URL and it worked as the base64_encoded string passed the regex pattern.

  • I could agree, but why would "foo==>" be recognized, while "foo=<=" isn't? – Max13 Jul 5 '16 at 23:47
  • 2
    @Max13 Possibly because <= (query string value) might fit the pattern of a XSS attack used to exploit a vulnerability on some servers/software. Check if you have mod_security installed and what rules are configured. Blocking seemingly obscure query string name/values is a common "feature". – MrWhite Jul 6 '16 at 8:09
  • 1
    @PlanetScale-networks @w3dk You were right. It was mod_security's fault: Message: Access denied with redirection to http://dev.rihan.fr/ using status 302 (phase 2). Pattern match "(?i:(\\!\\=|\\&\\&|\\|\\||>>|<<|>=|<=|<>|<=>|\\bxor\\b|\\brlike\\b|\\bregexp\\b|\\bisnull\\b)|..." – Max13 Jul 6 '16 at 8:32
  • Now, if I may ask, mod_security seemed to be a good idea to install... But when I check these query values on other websites, I don't have any error, even on CPanel's demo website or forum website. Does it mean mod_security is either unnecessary or worse, could be dangerous? – Max13 Jul 6 '16 at 8:42
  • 1
    Unfortunately you are unlikely to find a good answer for that on here. Whether mod_security is good or bad is entirely opinion based and I would be willing to bet that there are at least a dozen people on here who could argue for how good it is and a dozen who could argue for how bad it is, it mainly boils down to how you use it, what you need it for, and your own experiences with it, it is by no means needed for security, it simply makes it easier to add security by packaging a range of rules into a single module rather than you setting up each one manually. – Chris Rutherfurd Jul 6 '16 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.