< Back to JetLib.com

jetlib.sec » Tags » error-documents

« Expand/Collapse

1 item tagged "error documents"

Related tags: protocol [+], proof of concept [+], cookie [+], bad request [+], apache [+]

January 31, 2012
3:11
Apache protocol.c Cookie Disclosure
» ‎ Packet Storm Security Exploits

Proof of concept code for a vulnerability in protocol.c from Apache versions 2.2.x through 2.2.21. The issue is that it does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies.
Tags: cookie protocol apache proof-of-concept bad-request error-documents