E18-3gub1
CVSS:
8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
False Positive:
f
Variants:
10
Year:
2018
Description
This strike exploits a policy bypass vulnerability in Apache httpd FilesMatch.
FilesMatch is intended to prevent files which do not match certain regex patterns to be uploaded via HTTP PUT messages.
One of these patterns is AP_REG_DOLLAR_ENDONLY, which is intended to prevent files ending with the \n character.
However, this option does not work properly, allowing for files ending with \n to be uploaded.
An attacker can send a specially crafted HTTP PUT message to bypass the policy and upload arbitrary files.