3 ms·
They’ve suggested blocking ${ in the request
by yardstick 4y ago
They’ve suggested blocking ${ in the request
- Icingdeath 4y agoUsing nginx in front of my local confluence server (not listening on the internet) and used the following: location ~\* \$\{. { deny all; } but this only helps if this vulnerability is triggered using the request uri otherwise it's useless
- bombcar 4y agoAnyone know how you'd quote it for Apache rewrite? RewriteEngine On RewriteCond %{REQUEST_URI} ^.*\${.*$ RewriteRule ^/(.*) https://google.com [R=302,L] seems to work ...
- justin_oaks 4y agoThe security advisory from Atlassian says blocking ${ "may reduce your risk". That's a far cry from being a fix.
- technion 4y agoI really worry about these sort of claims. I'm seeing pushback from people about shutting servers down because it's insisted "a WAF is protecting us now", and that's based on a "may reduce risk".
- richbell 4y agoSame issue with log4shell. "Why are you bugging us? We already applied <mitigation posted 2 weeks ago that has since been disproven>."
- tyingq 4y agoI would worry about just using that blocking pattern. They mention OGNL injection and ${ is just one pattern you can go after. There's also #{, %{, #var, and more.
- jpetrucc 4y agoposting a snippet for HAProxy in case its helpful to someone else (or if others have recommendations on how to better do this) http-request deny if { path -m sub ${ } http-request deny if { query -m sub ${ } http-request deny if { path -m sub $%7B } http-request deny if { query -m sub $%7B } http-request deny if { path -m sub %24%7B } http-request deny if { query -m sub %24%7B }