general/9368: Apache serving files it should from bad URLs

[Walt Stoneburner <wl...@wwco.com>]

>Number:         9368
>Category:       general
>Synopsis:       Apache serving files it should from bad URLs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Fri Jan 04 12:40:01 PST 2002
>Closed-Date:
>Last-Modified:
>Originator:     wls@wwco.com
>Release:        1.3.22
>Organization:
apache
>Environment:
Solaris 8, update 5.  GCC 2.95.3

SunOS devint1 5.8 Generic_108528-09 sun4u sparc SUNW,Sun-Blade-100
>Description:
No core dumps, in fact the log files appear to show that everything is okay.

I've found the problem on two different Apache systems in our company, installed in different divisions, installed by different people.
>How-To-Repeat:
1. Create a legal HTML file called  /usr/local/apache/htdocs/xyzzy.html
2. Using any browser, pull up http://www.yourserver.com/xyzzy/bogus.html

For any file xxx.html, a path of /xxx/NoSuchFile.html will serve the file xxx.html.

It's acting as if when searching the directory listing for the directory, if it can't find it, it matches on the closest filename with that prefix.

3. Now, do a   mkdir /usr/local/apache/htdocs/xyzzy
   ...so you have both the newly created directory -and- the xyzzy.html file.
4. The URL now gives the expected 404 error.


This is using the original  httpd.conf.org  file for  httpd.conf
There is no directory aliasing going on.
There are no strange wild cards.
mod_spell is not compiled in.
mod_rewrite is not being used.
No 404 Error rules exist in the config file.
.htaccess does not exist

...in short, we can't figure out why this is happening, it only seems to be happening on the latest version of Apache (as best as we can tell).


This is serious in nature in that it's possible to access a file you shouldn't by constructing a false-path as shown above.
>Fix:
Creating an empty directory with the same filename (not extension) as the help file acts as a work around, but is a horrific hack.


This may just be data-point noise:
Does not appear to be PGP or Perl related.  (As we had one server with those mods and one without both act the same -- two completely different sites.)

The only similar module installed was SSL.  *However* in both cases SSL was not being used by the browser.
>Release-Note:
>Audit-Trail:
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <ap...@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]