I’ve seen the vulnerability described as a misconfigured mod_security server acting as a WAF. But how is it even possible to misconfigure something like this? F

I’ve seen the vulnerability described as a misconfigured mod_security server acting as a WAF. But how is it even possible to misconfigure something like this? Forwarding to a backend server dynamically based on the host header sounds like more work to setup than doing it statically. The ips for your hosts would have to resolve differently for the WAF host than publicly or else you would have a loop.