<p>Both Yii 1 and Yii 2 will check for the <code>X-Rewrite-URL</code> header when determining the requested URI, however no known vulnerabilities exist related to that, because Craft is sure to use the same URI (whatever its source) for both routing and any other URI-related logic throughout the system. So it’s not possible to have Craft base its routing on one URI and template logic off of another URI, for example.</p>

CC BY-SA 4.0
2018-10-29T20:46:46.030Z
I can't tell if this is a yes or a no. Sending more info to support. Thanks.
Steve Mock
CC BY-SA 4.0
2018-10-29T17:37:56.597Z
2018-10-29T17:37:56.597Z
Brandon Kelly
<p>Maybe.</p>

<p>Here's what Acunetix has to say about it.</p>

<blockquote>
  <p>The test checks if a web application supports headers X-Original-URL
  or X-Rewrite-URL.</p>
  
  <p>In this case, Craft CMS supports X-Rewrite-URL. Support of these
  headers is not a vulnerability itself, but more like misconfiguration
  which in some circumstances could lead to a vulnerability.</p>
  
  <p>For example, if there is a reverse proxy(e.g Nginx) in from of Craft
  CMS and an administrator wants to restrict access to /admin/, s/he can
  set a deny rule on the proxy for location /admin/.</p>
  
  <p>location /admin/ {
          deny all;
          return 403;
      }</p>
  
  <p>However an attacker is still able to access the admin interface as
  Nginx knows nothing about X-Rewrite-URL. So the attacker just sends a
  request like this:</p>
  
  <p>GET /something HTTP/1.1 Host: anything.com X-Rewrite-URL:
  /admin/login</p>
  
  <p>A similar problem could be if a website is located behind a cache
  proxy. In this case, an attacker may exploit the cache poisoning
  attack which leads to XSS. It's a more complicated one. More
  information could be found here:
  <a href="https://portswigger.net/blog/practical-web-cache-poisoning" rel="nofollow noreferrer">https://portswigger.net/blog/practical-web-cache-poisoning</a></p>
  
  <p>Therefore, the support of these headers (X-Original-URL or
  X-Rewrite-UR) doesn't lead to vulnerabilities of the site
  anything.com (at least, from the first glance), but it would be
  much safer for all user of Craft CMS if Craft CMS will make a fix
  (remove the support of these headers).</p>
</blockquote>

CC BY-SA 4.0
2018-11-28T13:07:02.613Z
2018-11-28T13:07:02.613Z
Steve Mock
<p>We could use some help tracking down a consistent error on our Craft installs according to Acunetix Security Audits.</p>

<p><strong>URL Rewrite Vulnerability</strong></p>

<blockquote>
  <p>It was identified that this application supports the legacy headers
  <strong>X-Original-URL</strong> and/or <strong>X-Rewrite-URL</strong>.</p>
  
  <p>Support for these headers lets users override the path in the request
  URL via the X-Original-URL or X-Rewrite-URL HTTP request header and
  allows a user to access one URL but have web application return a
  different one which can bypass restrictions on higher level caches and
  web servers.</p>
  
  <p>Many web frameworks such as Symfony 2.7.0 to 2.7.48, 2.8.0 to 2.8.43,
  3.3.0 to 3.3.17, 3.4.0 to 3.4.13, 4.0.0 to 4.0.13 and 4.1.0 to 4.1.2 , zend-diactoros up to 1.8.4, zend-http up to 2.8.1, zend-feed up to
  2.10.3 are affected by this security issue.</p>
</blockquote>

<p><a href="https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers" rel="nofollow noreferrer">https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers</a></p>

<p><a href="https://framework.zend.com/security/advisory/ZF2018-01" rel="nofollow noreferrer">https://framework.zend.com/security/advisory/ZF2018-01</a></p>

<ul>
<li><p>These sites are hosted on Forge / Linode servers.</p></li>
<li><p>Versions vary, but most are recent-ish Craft 2.X</p></li>
<li><p>A couple (though not all) use the Redirect Manager plugin</p></li>
</ul>

CC BY-SA 4.0
2018-10-29T14:58:56.767Z
The first and most important question... What version of Craft are you running?
Lindsey D
CC BY-SA 4.0
2018-10-29T15:00:05.823Z
Secondly, if you think this is a _newly discovered_ security issue with Craft, please report it directly to support@craftcms.com.
Lindsey D
CC BY-SA 4.0
2018-10-29T20:45:45.040Z
One site is 2.7.0 and two others are 2.7.2. There are more but I don't have the security scans in front of me right now.
Steve Mock
<redirect><security>
Does Craft Have a URL Rewrite Vulnerability?
# Does Craft Have a URL Rewrite Vulnerability?

(Asked by: username_0 on 2018-10-29)

We could use some help tracking down a consistent error on our Craft installs according to Acunetix Security Audits.

**URL Rewrite Vulnerability**

> It was identified that this application supports the legacy headers
> **X-Original-URL** and/or **X-Rewrite-URL**.
>
> Support for these headers lets users override the path in the request
> URL via the X-Original-URL or X-Rewrite-URL HTTP request header and
> allows a user to access one URL but have web application return a
> different one which can bypass restrictions on higher level caches and
> web servers.
>
> Many web frameworks such as Symfony 2.7.0 to 2.7.48, 2.8.0 to 2.8.43,
> 3.3.0 to 3.3.17, 3.4.0 to 3.4.13, 4.0.0 to 4.0.13 and 4.1.0 to 4.1.2 , zend-diactoros up to 1.8.4, zend-http up to 2.8.1, zend-feed up to
> 2.10.3 are affected by this security issue.

<https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers>

<https://framework.zend.com/security/advisory/ZF2018-01>

* These sites are hosted on Forge / Linode servers.
* Versions vary, but most are recent-ish Craft 2.X
* A couple (though not all) use the Redirect Manager plugin

**Tags:** redirect, security

> **Comments:**
> **username_1**: The first and most important question... What version of Craft are you running?  
> **username_1**: Secondly, if you think this is a _newly discovered_ security issue with Craft, please report it directly to support@craftcms.com.  
> **username_0**: One site is 2.7.0 and two others are 2.7.2. There are more but I don't have the security scans in front of me right now.  

---

## 2 answers

### Answer by username_2 on 2018-10-29. Score: 2

Both Yii 1 and Yii 2 will check for the `X-Rewrite-URL` header when determining the requested URI, however no known vulnerabilities exist related to that, because Craft is sure to use the same URI (whatever its source) for both routing and any other URI-related logic throughout the system. So it’s not possible to have Craft base its routing on one URI and template logic off of another URI, for example.

> **Comments:**
> **username_0**: I can't tell if this is a yes or a no. Sending more info to support. Thanks.  

---

### Answer by username_0 on 2018-11-28. Score: 0

Maybe.

Here's what Acunetix has to say about it.

> The test checks if a web application supports headers X-Original-URL
> or X-Rewrite-URL.
>
> In this case, Craft CMS supports X-Rewrite-URL. Support of these
> headers is not a vulnerability itself, but more like misconfiguration
> which in some circumstances could lead to a vulnerability.
>
> For example, if there is a reverse proxy(e.g Nginx) in from of Craft
> CMS and an administrator wants to restrict access to /admin/, s/he can
> set a deny rule on the proxy for location /admin/.
>
> location /admin/ {
> deny all;
> return 403;
> }
>
> However an attacker is still able to access the admin interface as
> Nginx knows nothing about X-Rewrite-URL. So the attacker just sends a
> request like this:
>
> GET /something HTTP/1.1 Host: anything.com X-Rewrite-URL:
> /admin/login
>
> A similar problem could be if a website is located behind a cache
> proxy. In this case, an attacker may exploit the cache poisoning
> attack which leads to XSS. It's a more complicated one. More
> information could be found here:
> <https://portswigger.net/blog/practical-web-cache-poisoning>
>
> Therefore, the support of these headers (X-Original-URL or
> X-Rewrite-UR) doesn't lead to vulnerabilities of the site
> anything.com (at least, from the first glance), but it would be
> much safer for all user of Craft CMS if Craft CMS will make a fix
> (remove the support of these headers).


---

