https://github.com/mbadanoiu/cve-2019-10092

CVE-2019-10092: Limited Cross-Site Scripting via "Proxy Error" Page in Apache HTTP Server
https://github.com/mbadanoiu/cve-2019-10092

0-day cve cve-2019-10092 cves open-redirect user-interaction

Last synced: 2 days ago
JSON representation

CVE-2019-10092: Limited Cross-Site Scripting via "Proxy Error" Page in Apache HTTP Server

• Host: GitHub
• URL: https://github.com/mbadanoiu/cve-2019-10092
• Owner: mbadanoiu
• Created: 2024-05-27T20:09:36.000Z (6 months ago)
• Default Branch: main
• Last Pushed: 2024-06-09T20:18:45.000Z (5 months ago)
• Last Synced: 2024-06-09T21:44:41.730Z (5 months ago)
• Topics: 0-day, cve, cve-2019-10092, cves, open-redirect, user-interaction
• Homepage:
• Size: 679 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# CVE-2019-10092: Limited Cross-Site Scripting via "Proxy Error" Page in Apache HTTP Server

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://httpd.apache.org/security/vulnerabilities_24.html).

### Requirements:

This vulnerability requires:




- A way to reach the "Proxy Error" page

- User interaction

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2019-10092/blob/main/Apache%20Httpd%20-%20CVE-2019-10092.pdf).

### Additional Resources:

Alternative method for exploiting CVE-2019-10092 presented by Sebastian Neef in this [blog post](https://0day.work/proof-of-concept-for-apache-httpd-limited-cross-site-scripting-in-mod_proxy-error-page-cve-2019-10092/)