HTTPoxy Vulnerability


Status
Not open for further replies.
Setahu saya hanya litespeed yang melalukan patch. Sedangkan web server lain tidak ada tapi cukup dengan menyesuaikan file konfigurasi.
 
FluidaWeb said:
saya sudah melakukan patch webserver nginx saya, apa bisa dibantu pak @mustafaramadhan untuk cek web di signature sya apa masih vulnerable
Click to expand...
Ini perbandingan punya saya dan punya anda:
Code: 
> cd /tmp; wget -S --header="Proxy: 1.2.3.4:8080" https://mratwork.com/
--2016-07-21 12:12:48--  https://mratwork.com/
Resolving mratwork.com... 62.210.181.21
Connecting to mratwork.com|62.210.181.21|:443... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 403 Forbidden
  Date: Fri, 22 Jul 2016 12:10:21 GMT
  Server: Hiawatha v10.3
  Accept-Ranges: bytes
  Connection: keep-alive
  X-Hiawatha-Cache: 5
  Strict-Transport-Security: max-age=2592000;preload
  X-Supported-By: Kloxo-MR 7.0
  Access-Control-Allow-Origin: *
  X-Frame-Options: SAMEORIGIN
  X-XSS-Protection: 1;mode=block
  X-Content-Type-Options: nosniff
  Content-Length: 857
  Content-Type: text/html
2016-07-21 12:12:49 ERROR 403: Forbidden.
Code: 
> cd /tmp; wget -S --header="Proxy: 1.2.3.4:8080" https://www.shehoster.com/
--2016-07-21 12:13:01--  https://www.shehoster.com/
Resolving www.shehoster.com... 108.61.223.152
Connecting to www.shehoster.com|108.61.223.152|:443... connected.
HTTP request sent, awaiting response...
  HTTP/1.1 200 OK
  Date: Fri, 22 Jul 2016 12:29:42 GMT
  Content-Type: text/html; charset=utf-8
  Content-Length: 32100
  Last-Modified: Sat, 16 Jul 2016 12:05:24 GMT
  Connection: keep-alive
  Vary: Accept-Encoding
  ETag: "578a2304-7d64"
  Server: Google Webserver
  Expires: Sat, 23 Jul 2016 12:29:42 GMT
  Cache-Control: max-age=86400
  Strict-Transport-Security: max-age=31536000
  Accept-Ranges: bytes
Length: 32100 (31K) [text/html]
Saving to: `index.html.3'

     0K .......... .......... .......... .                    100%  210K=0.1s

2016-07-21 12:13:02 (210 KB/s) - `index.html.3' saved [32100/32100]
 
Pakai ini
Code: 
<?php

if (!function_exists('getallheaders'))  {
    function getallheaders()
    {
        if (!is_array($_SERVER)) {
            return array();
        }

        $headers = array();
        foreach ($_SERVER as $name => $value) {
            if (substr($name, 0, 5) == 'HTTP_') {
                $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
            }
        }
        return $headers;
    }
}



if (isset($_GET['check']) && $_GET['check'] == 'yes')
{
    $hs = getallheaders();

    if (isset($hs['Proxy']) || isset($hs['proxy']))
        echo "bad";
    else
        echo "good";
    exit(0);
}


$http='http';
if ($_SERVER['HTTPS'] == 'on')
    $http='https';

$url = "$http://".$_SERVER['HTTP_HOST'].$_SERVER["SCRIPT_NAME"]."?check=yes";

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HTTPHEADER, array("Proxy: evil"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$r = curl_exec($ch);
if ($r === false)
    echo curl_error($ch);

if ($r == 'good')
{
    ?><b>Good!</b>  Proxy has been filtered out.  No need to do anything<?php
}
elseif ($r == 'bad')
{
    ?><b>Bad!</b> You'll need to filter out the proxy header in your configs.<?php
}
else
{
    ?>No idea.. something went wrong:<br><textarea cols=80 rows=10><?=$r?></textarea><?php
}


curl_close($ch);


?>

Upload dan akses, Kalau keluarnya good artinya sudah di patch.
 
GPLHosting said:
Om @mustafaramadhan .. yg forum.mratwork.com dan hostspectra.com ngga sekalian di mitigasi ?
Click to expand...
Sudah dimitigasi. Berbeda hasil karena pakai hiawatha--proxy sedangkan mratwork.com pakai hiawatha (ingat Kloxo-MR 7.0 memungkinkan setiap website memilih pure hiawatha atau hiawatha-proxy jika server dipilih hiawatha-proxy sebagai webserver; ini juga berlaku untuk nginx-proxy dan lighttpd-proxy).

Pada pure hiawatha, hasil dari wget akan 'forbidden'. Sedangkan pada hiawatha-proxy hasilnya berupa proses donwload yang tidak selesai-selesai.
 
GPLHosting said:
Om @mustafaramadhan .. yg forum.mratwork.com dan hostspectra.com ngga sekalian di mitigasi ?
Click to expand...
Ternyata ada logic untuk bagian reverseproxy di hiawatha-proxy yang perlu di-fixed. SIlahkan periksa lagi hostspectra.com (pakai hiawatha-proxy) dan mratwork.com (pakai pure hiawatha).:16:
 
Status
Not open for further replies.
Back
Top