Answers.Body: <p>Both Yii 1 and Yii 2 will check for the <code>X-Rewrite-URL</code> header when determining the requested URI, however no known vulnerabilities exist related to that, because Craft is sure to use the same URI (whatever its source) for both routing and any other URI-related logic throughout the system. So it’s not possible to have Craft base its routing on one URI and template logic off of another URI, for example.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-29T20:46:46.030Z
Answers.Text: I can't tell if this is a yes or a no. Sending more info to support. Thanks.
Answers.UserDisplayName: Steve Mock
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-29T17:37:56.597Z
Answers.LastActivityDate: 2018-10-29T17:37:56.597Z
Answers.UserDisplayName: Brandon Kelly
Answers.Body: <p>Maybe.</p>
  
  <p>Here's what Acunetix has to say about it.</p>
  
  <blockquote>
    <p>The test checks if a web application supports headers X-Original-URL
    or X-Rewrite-URL.</p>
    
    <p>In this case, Craft CMS supports X-Rewrite-URL. Support of these
    headers is not a vulnerability itself, but more like misconfiguration
    which in some circumstances could lead to a vulnerability.</p>
    
    <p>For example, if there is a reverse proxy(e.g Nginx) in from of Craft
    CMS and an administrator wants to restrict access to /admin/, s/he can
    set a deny rule on the proxy for location /admin/.</p>
    
    <p>location /admin/ {
            deny all;
            return 403;
        }</p>
    
    <p>However an attacker is still able to access the admin interface as
    Nginx knows nothing about X-Rewrite-URL. So the attacker just sends a
    request like this:</p>
    
    <p>GET /something HTTP/1.1 Host: anything.com X-Rewrite-URL:
    /admin/login</p>
    
    <p>A similar problem could be if a website is located behind a cache
    proxy. In this case, an attacker may exploit the cache poisoning
    attack which leads to XSS. It's a more complicated one. More
    information could be found here:
    <a href="https://portswigger.net/blog/practical-web-cache-poisoning" rel="nofollow noreferrer">https://portswigger.net/blog/practical-web-cache-poisoning</a></p>
    
    <p>Therefore, the support of these headers (X-Original-URL or
    X-Rewrite-UR) doesn't lead to vulnerabilities of the site
    anything.com (at least, from the first glance), but it would be
    much safer for all user of Craft CMS if Craft CMS will make a fix
    (remove the support of these headers).</p>
  </blockquote>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-28T13:07:02.613Z
Answers.LastActivityDate: 2018-11-28T13:07:02.613Z
Answers.UserDisplayName: Steve Mock
Body: <p>We could use some help tracking down a consistent error on our Craft installs according to Acunetix Security Audits.</p>
  
  <p><strong>URL Rewrite Vulnerability</strong></p>
  
  <blockquote>
    <p>It was identified that this application supports the legacy headers
    <strong>X-Original-URL</strong> and/or <strong>X-Rewrite-URL</strong>.</p>
    
    <p>Support for these headers lets users override the path in the request
    URL via the X-Original-URL or X-Rewrite-URL HTTP request header and
    allows a user to access one URL but have web application return a
    different one which can bypass restrictions on higher level caches and
    web servers.</p>
    
    <p>Many web frameworks such as Symfony 2.7.0 to 2.7.48, 2.8.0 to 2.8.43,
    3.3.0 to 3.3.17, 3.4.0 to 3.4.13, 4.0.0 to 4.0.13 and 4.1.0 to 4.1.2 , zend-diactoros up to 1.8.4, zend-http up to 2.8.1, zend-feed up to
    2.10.3 are affected by this security issue.</p>
  </blockquote>
  
  <p><a href="https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers" rel="nofollow noreferrer">https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers</a></p>
  
  <p><a href="https://framework.zend.com/security/advisory/ZF2018-01" rel="nofollow noreferrer">https://framework.zend.com/security/advisory/ZF2018-01</a></p>
  
  <ul>
  <li><p>These sites are hosted on Forge / Linode servers.</p></li>
  <li><p>Versions vary, but most are recent-ish Craft 2.X</p></li>
  <li><p>A couple (though not all) use the Redirect Manager plugin</p></li>
  </ul>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-10-29T14:58:56.767Z
Comments.Text: The first and most important question... What version of Craft are you running?
Comments.UserDisplayName: Lindsey D
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-10-29T15:00:05.823Z
Comments.Text: Secondly, if you think this is a _newly discovered_ security issue with Craft, please report it directly to support@craftcms.com.
Comments.UserDisplayName: Lindsey D
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-10-29T20:45:45.040Z
Comments.Text: One site is 2.7.0 and two others are 2.7.2. There are more but I don't have the security scans in front of me right now.
Comments.UserDisplayName: Steve Mock
Tags: <redirect><security>
Title: Does Craft Have a URL Rewrite Vulnerability?
ThreadText: # Does Craft Have a URL Rewrite Vulnerability?
  
  (Asked by: username_0 on 2018-10-29)
  
  We could use some help tracking down a consistent error on our Craft installs according to Acunetix Security Audits.
  
  **URL Rewrite Vulnerability**
  
  > It was identified that this application supports the legacy headers
  > **X-Original-URL** and/or **X-Rewrite-URL**.
  >
  > Support for these headers lets users override the path in the request
  > URL via the X-Original-URL or X-Rewrite-URL HTTP request header and
  > allows a user to access one URL but have web application return a
  > different one which can bypass restrictions on higher level caches and
  > web servers.
  >
  > Many web frameworks such as Symfony 2.7.0 to 2.7.48, 2.8.0 to 2.8.43,
  > 3.3.0 to 3.3.17, 3.4.0 to 3.4.13, 4.0.0 to 4.0.13 and 4.1.0 to 4.1.2 , zend-diactoros up to 1.8.4, zend-http up to 2.8.1, zend-feed up to
  > 2.10.3 are affected by this security issue.
  
  <https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers>
  
  <https://framework.zend.com/security/advisory/ZF2018-01>
  
  * These sites are hosted on Forge / Linode servers.
  * Versions vary, but most are recent-ish Craft 2.X
  * A couple (though not all) use the Redirect Manager plugin
  
  **Tags:** redirect, security
  
  > **Comments:**
  > **username_1**: The first and most important question... What version of Craft are you running?  
  > **username_1**: Secondly, if you think this is a _newly discovered_ security issue with Craft, please report it directly to support@craftcms.com.  
  > **username_0**: One site is 2.7.0 and two others are 2.7.2. There are more but I don't have the security scans in front of me right now.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2018-10-29. Score: 2
  
  Both Yii 1 and Yii 2 will check for the `X-Rewrite-URL` header when determining the requested URI, however no known vulnerabilities exist related to that, because Craft is sure to use the same URI (whatever its source) for both routing and any other URI-related logic throughout the system. So it’s not possible to have Craft base its routing on one URI and template logic off of another URI, for example.
  
  > **Comments:**
  > **username_0**: I can't tell if this is a yes or a no. Sending more info to support. Thanks.  
  
  ---
  
  ### Answer by username_0 on 2018-11-28. Score: 0
  
  Maybe.
  
  Here's what Acunetix has to say about it.
  
  > The test checks if a web application supports headers X-Original-URL
  > or X-Rewrite-URL.
  >
  > In this case, Craft CMS supports X-Rewrite-URL. Support of these
  > headers is not a vulnerability itself, but more like misconfiguration
  > which in some circumstances could lead to a vulnerability.
  >
  > For example, if there is a reverse proxy(e.g Nginx) in from of Craft
  > CMS and an administrator wants to restrict access to /admin/, s/he can
  > set a deny rule on the proxy for location /admin/.
  >
  > location /admin/ {
  > deny all;
  > return 403;
  > }
  >
  > However an attacker is still able to access the admin interface as
  > Nginx knows nothing about X-Rewrite-URL. So the attacker just sends a
  > request like this:
  >
  > GET /something HTTP/1.1 Host: anything.com X-Rewrite-URL:
  > /admin/login
  >
  > A similar problem could be if a website is located behind a cache
  > proxy. In this case, an attacker may exploit the cache poisoning
  > attack which leads to XSS. It's a more complicated one. More
  > information could be found here:
  > <https://portswigger.net/blog/practical-web-cache-poisoning>
  >
  > Therefore, the support of these headers (X-Original-URL or
  > X-Rewrite-UR) doesn't lead to vulnerabilities of the site
  > anything.com (at least, from the first glance), but it would be
  > much safer for all user of Craft CMS if Craft CMS will make a fix
  > (remove the support of these headers).
  
  
  ---
  
  