CVE-2007-6203
published 2007-12-03CVE-2007-6203: Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity…
PriorityP430medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
80.75%
99.6th percentile
Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandecho -en "<script> / HTTP/1.1\nHost: $i\nConnection: close\nContent-length: 0\nContent-length: 0\n\n" | nc -w 4 $i 80↗
- →Look for HTTP requests where the Method field contains HTML/script tags or XSS payloads (e.g., '<script>') instead of a valid HTTP verb, which will be reflected unsanitized in a 413 error response. ↗
- →Detect exploitation attempts by monitoring for HTTP requests with duplicate or invalid Content-length headers (e.g., two 'Content-length: 0' headers) combined with a non-standard or script-injected HTTP method, triggering a 413 response. ↗
- →Alert on 413 HTTP responses from Apache 2.0.46 through 2.2.4 where the response body echoes back an unsanitized HTTP method string. ↗
- →Monitor Apache access/error logs for requests where the HTTP method field contains characters such as '<', '>', '"', or '/' that are not part of a valid RFC method token, indicating a potential XSS injection attempt. ↗
- ·The vulnerability is fixed in Apache 2.2.6-3 (Debian) and patched via RHBA-2009:0185 (RHEL 5) / RHBA-2008:0763 (RHEL 4). Unpatched Apache 2.0.x and 2.2.x up to 2.2.4 remain affected. Red Hat does not classify this as a security vulnerability but addressed it as a bug fix. ↗
- ·Exploitation requires the attacker to force the victim's HTTP client to send an arbitrary malformed HTTP method; standard browsers and plugins do not permit this, significantly limiting real-world exploitability. ↗
- ·The Apache SVN patch (revision 600645) escapes the request method in built-in HTTP error responses; verify this patch is applied when assessing httpd installations. ↗
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
vendor_redhat4.3MEDIUM
vendor_ubuntu4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g7xr-j224-9v5w: Apache HTTP Server 2
ghsa_unreviewed·2022-05-01·CVSS 4.3
CVE-2007-6203 [MEDIUM] CWE-79 GHSA-g7xr-j224-9v5w: Apache HTTP Server 2
Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
OSV
CVE-2007-6203: Apache HTTP Server 2
osv·2007-12-03·CVSS 4.3
CVE-2007-6203 [MEDIUM] CVE-2007-6203: Apache HTTP Server 2
Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
Ubuntu
Apache vulnerabilities
vendor_ubuntu·2009-03-10·CVSS 4.3
CVE-2007-6203 [MEDIUM] Apache vulnerabilities
Title: Apache vulnerabilities
Summary: Apache vulnerabilities
It was discovered that Apache did not sanitize the method specifier header from
an HTTP request when it is returned in an error message, which could result in
browsers becoming vulnerable to cross-site scripting attacks when processing the
output. With cross-site scripting vulnerabilities, if a user were tricked into
viewing server output during a crafted server request, a remote attacker could
exploit this to modify the contents, or steal confidential data (such as
passwords), within the same domain. This issue only affected Ubuntu 6.06 LTS and
7.10. (CVE-2007-6203)
It was discovered that Apache was vulnerable to a cross-site request forgery
(CSRF) in the mod_proxy_balancer balancer manager. If an Apache administrator
were t
Red Hat
httpd: Garbage before http method name is not escaped in a reply in case of errorneous request
vendor_redhat·2007-11-30·CVSS 4.3
CVE-2007-6203 [MEDIUM] httpd: Garbage before http method name is not escaped in a reply in case of errorneous request
httpd: Garbage before http method name is not escaped in a reply in case of errorneous request
Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
Statement: Red Hat does not consider this issue to be a vulnerability. In order to exploit this for cross-site scripting, the attacker would have to get the victim to supply an arbitrary malformed HTTP method to a target site. However, this has been fixed in Red Hat Enterp
Debian
CVE-2007-6203: apache2 - Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier h...
vendor_debian·2007·CVSS 4.3
CVE-2007-6203 [MEDIUM] CVE-2007-6203: apache2 - Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier h...
Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
Scope: local
bookworm: resolved (fixed in 2.2.6-3)
bullseye: resolved (fixed in 2.2.6-3)
forky: resolved (fixed in 2.2.6-3)
sid: resolved (fixed in 2.2.6-3)
trixie: resolved (fixed in 2.2.6-3)
No detection rules found.
http://docs.info.apple.com/article.html?artnum=307562http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.htmlhttp://marc.info/?l=bugtraq&m=125631037611762&w=2http://marc.info/?l=bugtraq&m=129190899612998&w=2http://procheckup.com/Vulnerability_PR07-37.phphttp://secunia.com/advisories/27906http://secunia.com/advisories/28196http://secunia.com/advisories/29348http://secunia.com/advisories/29420http://secunia.com/advisories/29640http://secunia.com/advisories/30356http://secunia.com/advisories/30732http://secunia.com/advisories/33105http://secunia.com/advisories/34219http://security.gentoo.org/glsa/glsa-200803-19.xmlhttp://securityreason.com/securityalert/3411http://www-1.ibm.com/support/docview.wss?uid=swg1PK57952http://www-1.ibm.com/support/docview.wss?uid=swg24019245http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.htmlhttp://www.securityfocus.com/archive/1/484410/100/0/threadedhttp://www.securityfocus.com/bid/26663http://www.securitytracker.com/id?1019030http://www.ubuntu.com/usn/USN-731-1http://www.vupen.com/english/advisories/2007/4060http://www.vupen.com/english/advisories/2007/4301http://www.vupen.com/english/advisories/2008/0924/referenceshttp://www.vupen.com/english/advisories/2008/1623/referenceshttp://www.vupen.com/english/advisories/2008/1875/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/38800https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12166http://docs.info.apple.com/article.html?artnum=307562http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.htmlhttp://marc.info/?l=bugtraq&m=125631037611762&w=2http://marc.info/?l=bugtraq&m=129190899612998&w=2http://procheckup.com/Vulnerability_PR07-37.phphttp://secunia.com/advisories/27906http://secunia.com/advisories/28196http://secunia.com/advisories/29348http://secunia.com/advisories/29420http://secunia.com/advisories/29640http://secunia.com/advisories/30356http://secunia.com/advisories/30732http://secunia.com/advisories/33105http://secunia.com/advisories/34219http://security.gentoo.org/glsa/glsa-200803-19.xmlhttp://securityreason.com/securityalert/3411http://www-1.ibm.com/support/docview.wss?uid=swg1PK57952http://www-1.ibm.com/support/docview.wss?uid=swg24019245http://www.fujitsu.com/global/support/software/security/products-f/interstage-200807e.htmlhttp://www.securityfocus.com/archive/1/484410/100/0/threadedhttp://www.securityfocus.com/bid/26663http://www.securitytracker.com/id?1019030http://www.ubuntu.com/usn/USN-731-1http://www.vupen.com/english/advisories/2007/4060http://www.vupen.com/english/advisories/2007/4301http://www.vupen.com/english/advisories/2008/0924/referenceshttp://www.vupen.com/english/advisories/2008/1623/referenceshttp://www.vupen.com/english/advisories/2008/1875/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/38800https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12166
2007-12-03
Published