Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:APACHE:FILEMATCH-BYPASS |
|---|---|
Severity |
Major |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Apache httpd FilesMatch Directive Security Restriction Bypass |
Release Date |
2018/05/10 |
Update Number |
3064 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Apache httpd FilesMatch Directive Security Restriction Bypass
This signature detects attempts to exploit a known vulnerability against Apache httpd. A remote attacker can exploit this vulnerability by sending a HTTP PUT request with crafted URI to the remote HTTP server. Successful exploitation could result in security policy bypass and arbitrary file upload if the HTTP server is configured to allow file uploading like HTTP PUT method.
Extended Description
In Apache httpd 2.4.0 to 2.4.29, the expression specified in
Affected Products
- Apache http_server 2.4.0
- Apache http_server 2.4.1
- Apache http_server 2.4.10
- Apache http_server 2.4.12
- Apache http_server 2.4.14
- Apache http_server 2.4.16
- Apache http_server 2.4.17
- Apache http_server 2.4.18
- Apache http_server 2.4.19
- Apache http_server 2.4.2
- Apache http_server 2.4.20
- Apache http_server 2.4.21
- Apache http_server 2.4.22
- Apache http_server 2.4.23
- Apache http_server 2.4.24
- Apache http_server 2.4.25
- Apache http_server 2.4.26
- Apache http_server 2.4.27
- Apache http_server 2.4.28
- Apache http_server 2.4.29
- Apache http_server 2.4.3
- Apache http_server 2.4.4
- Apache http_server 2.4.6
- Apache http_server 2.4.7
- Apache http_server 2.4.8
- Apache http_server 2.4.9
- Canonical ubuntu_linux 14.04
- Canonical ubuntu_linux 16.04
- Canonical ubuntu_linux 17.10
- Canonical ubuntu_linux 18.04
- Debian debian_linux 8.0
- Debian debian_linux 9.0
- Netapp clustered_data_ontap -
- Netapp santricity_cloud_connector -
- Netapp storage_automation_store -
- Netapp storagegrid -
- Redhat enterprise_linux 6.0
- Redhat enterprise_linux 7.0
- Redhat enterprise_linux 7.4
- Redhat enterprise_linux 7.5
- Redhat enterprise_linux 7.6
References
- CVE: CVE-2017-15715