CVE-2013-5704
published 2014-04-15CVE-2013-5704: The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer…
PriorityP348medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
60.20%
99.0th percentile
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
Affected
74 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attackers exploit CVE-2013-5704 by placing malicious headers in the trailer portion of chunked transfer-encoded requests to bypass RequestHeader unset directives in mod_headers. ↗
- →The attack vector is placing a header in the trailer portion of data sent with chunked transfer coding to bypass 'RequestHeader unset' directives. ↗
- →The vulnerability allows HTTP trailers to replace HTTP headers during request processing, enabling bypass of RequestHeaders directives. ↗
- ·The affected component is the mod_headers module in Apache HTTP Server; the flaw is triggered only when chunked transfer encoding is used and RequestHeader unset directives are configured. ↗
- ·Red Hat Certificate System is not affected even when mod_headers is installed, because it does not use the mod_headers module. ↗
- ·The fix was introduced in Apache 2.4.10-2 (Debian packaging); versions prior to this remain vulnerable. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gwg2-5774-jpjm: The mod_headers module in the Apache HTTP Server 2
ghsa_unreviewed·2022-05-13
CVE-2013-5704 [MEDIUM] GHSA-gwg2-5774-jpjm: The mod_headers module in the Apache HTTP Server 2
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
OSV
apache2 vulnerabilities
osv·2015-03-10·CVSS 5.0
CVE-2013-5704 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
Martin Holst Swende discovered that the mod_headers module allowed HTTP
trailers to replace HTTP headers during request processing. A remote
attacker could possibly use this issue to bypass RequestHeaders directives.
(CVE-2013-5704)
Mark Montague discovered that the mod_cache module incorrectly handled
empty HTTP Content-Type headers. A remote attacker could use this issue to
cause the server to stop responding, leading to a denial of service. This
issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2014-3581)
Teguh P. Alko discovered that the mod_proxy_fcgi module incorrectly
handled long response headers. A remote attacker could use this issue to
cause the server to stop responding, leading to a denial of service. This
issue only affected Ubuntu 14.10.
OSV
CVE-2013-5704: The mod_headers module in the Apache HTTP Server 2
osv·2014-04-15·CVSS 5.0
CVE-2013-5704 [MEDIUM] CVE-2013-5704: The mod_headers module in the Apache HTTP Server 2
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2015-03-10·CVSS 5.0
CVE-2013-5704 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in the Apache HTTP Server.
Martin Holst Swende discovered that the mod_headers module allowed HTTP
trailers to replace HTTP headers during request processing. A remote
attacker could possibly use this issue to bypass RequestHeaders directives.
(CVE-2013-5704)
Mark Montague discovered that the mod_cache module incorrectly handled
empty HTTP Content-Type headers. A remote attacker could use this issue to
cause the server to stop responding, leading to a denial of service. This
issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2014-3581)
Teguh P. Alko discovered that the mod_proxy_fcgi module incorrectly
handled long response headers. A remote attacker could use this issue to
cause the server t
Red Hat
httpd: bypass of mod_headers rules via chunked requests
vendor_redhat·2013-10-19·CVSS 5.0
CVE-2013-5704 [MEDIUM] CWE-287 httpd: bypass of mod_headers rules via chunked requests
httpd: bypass of mod_headers rules via chunked requests
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
Statement: This issue affects the versions of the httpd package as shipped with Red Hat JBoss Enterprise Application Platfor
Debian
CVE-2013-5704: apache2 - The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers ...
vendor_debian·2013·CVSS 5.0
CVE-2013-5704 [MEDIUM] CVE-2013-5704: apache2 - The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers ...
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
Scope: local
bookworm: resolved (fixed in 2.4.10-2)
bullseye: resolved (fixed in 2.4.10-2)
forky: resolved (fixed in 2.4.10-2)
sid: resolved (fixed in 2.4.10-2)
trixie: resolved (fixed in 2.4.10-2)
Apple
CVE-2013-5704: OS X Server v5.0.3
vendor_apple·CVSS 5.0
CVE-2013-5704 [MEDIUM] CVE-2013-5704: OS X Server v5.0.3
Apple Security Update: About the security content of OS X Server v5.0.3
Product: OS X Server v5.0.3
CVE: CVE-2013-5704
Component: CVE-2013-5704
Apple
CVE-2013-5704: OS X Yosemite v10.10.3 and Security Update 2015-004
vendor_apple·CVSS 5.0
CVE-2013-5704 [MEDIUM] CVE-2013-5704: OS X Yosemite v10.10.3 and Security Update 2015-004
Apple Security Update: About the security content of OS X Yosemite v10.10.3 and Security Update 2015-004
Product: OS X Yosemite v10.10.3 and Security Update 2015-004
CVE: CVE-2013-5704
Component: CVE-2013-5704
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-5704 httpd: bypass of mod_headers rules via chunked requests
bugzilla·2014-04-01·CVSS 5.0
CVE-2013-5704 [MEDIUM] CVE-2013-5704 httpd: bypass of mod_headers rules via chunked requests
CVE-2013-5704 httpd: bypass of mod_headers rules via chunked requests
Martin Holst Swende discovered a flaw in the way mod_headers handled chunked requests. A remote attacker could use this flaw to bypass intended mod_headers restrictions, allowing them to send requests to applications that include headers that should have been removed by mod_headers.
Discussion and a possible patch is available from the following thread:
http://marc.info/?t=138219209900002&r=1&w=2
References:
http://martin.swende.se/blog/HTTPChunked.html
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1082908]
---
My position on this:
http://marc.info/?l=apache-httpd-dev&m=139636309822854&w=2
---
This could really be considered as a border line security case, perhaps even dism
Bugzilla
CVE-2013-5704 httpd: bypass of mod_headers rules via chunked requests [fedora-all]
bugzilla·2014-04-01·CVSS 5.0
CVE-2013-5704 [MEDIUM] CVE-2013-5704 httpd: bypass of mod_headers rules via chunked requests [fedora-all]
CVE-2013-5704 httpd: bypass of mod_headers rules via chunked requests [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issu
Qualys
Protect Your Applications from Hacker Research | Qualys
blogs_qualys·2015-01-26
Protect Your Applications from Hacker Research | Qualys
The prevalence of accidents, like that of vulnerabilities, tells us there is no perfect thing. And even if any given vulnerability is unexpected, we know from experience that the existence of vulnerabilities is inevitable. Hackers know this too, of course, and a determined hacker will use whatever tools are available to him to find vulnerabilities to exploit. One of the most obvious tools for a hacker is research, and simply inspecting the data your application publishes about itself can yield helpful information to a hacker. But how much data your application makes available to hacker research is within your control. It is feasible to mitigate the risk of hacker research by implementing policy compliance best practices. As a Policy Compliance signature developer, I will take Apache HTTP S
Qualys
Protect Your Applications from Hacker Research | Qualys
blogs_qualys·2015-01-26
Protect Your Applications from Hacker Research | Qualys
The prevalence of accidents, like that of vulnerabilities, tells us there is no perfect thing. And even if any given vulnerability is unexpected, we know from experience that the existence of vulnerabilities is inevitable. Hackers know this too, of course, and a determined hacker will use whatever tools are available to him to find vulnerabilities to exploit. One of the most obvious tools for a hacker is research, and simply inspecting the data your application publishes about itself can yield helpful information to a hacker. But how much data your application makes available to hacker research is within your control. It is feasible to mitigate the risk of hacker research by implementing policy compliance best practices. As a Policy Compliance signature developer, I will take Apache HTTP S
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlhttp://marc.info/?l=apache-httpd-dev&m=139636309822854&w=2http://marc.info/?l=bugtraq&m=143403519711434&w=2http://marc.info/?l=bugtraq&m=144493176821532&w=2http://martin.swende.se/blog/HTTPChunked.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0325.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1249.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2661.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0061.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0062.htmlhttp://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGEShttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.chttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1610674&r2=1610814&diff_format=hhttp://www.mandriva.com/security/advisories?name=MDVSA-2014:174http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/66550http://www.ubuntu.com/usn/USN-2523-1https://access.redhat.com/errata/RHSA-2015:2659https://access.redhat.com/errata/RHSA-2015:2660https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://security.gentoo.org/glsa/201504-03https://support.apple.com/HT204659https://support.apple.com/HT205219http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlhttp://marc.info/?l=apache-httpd-dev&m=139636309822854&w=2http://marc.info/?l=bugtraq&m=143403519711434&w=2http://marc.info/?l=bugtraq&m=144493176821532&w=2http://martin.swende.se/blog/HTTPChunked.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0325.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1249.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2661.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0061.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0062.htmlhttp://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGEShttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.chttp://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1610674&r2=1610814&diff_format=hhttp://www.mandriva.com/security/advisories?name=MDVSA-2014:174http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/66550http://www.ubuntu.com/usn/USN-2523-1https://access.redhat.com/errata/RHSA-2015:2659https://access.redhat.com/errata/RHSA-2015:2660https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3Ehttps://security.gentoo.org/glsa/201504-03https://support.apple.com/HT204659https://support.apple.com/HT205219
2014-04-15
Published