CVE-2002-0840 in HTTP Server
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/23/2024
This cross-site scripting vulnerability exists in Apache web server versions prior to 2.0.43 and 1.3.26 where the default error page fails to properly sanitize user input from the Host header. The flaw occurs specifically when the UseCanonicalName directive is set to "Off" and the server supports wildcard DNS configurations. This configuration creates a scenario where malicious actors can inject malicious scripts into the Host header, which then gets reflected in the server's default error page displayed to other users. The vulnerability represents a classic reflected XSS attack vector where the malicious payload is executed in the context of other users' browsers when they encounter the error page.
The technical implementation of this vulnerability leverages Apache's handling of canonical names and error page generation. When UseCanonicalName is disabled, Apache does not perform proper canonicalization of the Host header, allowing arbitrary input to be processed directly in error messages. The combination with wildcard DNS support amplifies the attack surface as the server cannot properly validate or sanitize incoming host information. This creates a direct pathway for attackers to inject JavaScript code that executes in the victim's browser context, potentially leading to session hijacking, credential theft, or defacement of web applications. The vulnerability is classified under CWE-79 as a failure to sanitize user input in error messages, making it a variant of reflected cross-site scripting attacks.
The operational impact of this vulnerability extends beyond simple script execution as it can be exploited to compromise user sessions and steal sensitive information. Attackers can craft malicious Host headers that contain JavaScript payloads designed to steal cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users. This represents a significant threat to web application security since the vulnerability affects the server's fundamental error handling mechanisms rather than specific application code. The attack requires minimal sophistication and can be automated, making it particularly dangerous in environments where Apache serves as a primary web server platform. The vulnerability's classification under ATT&CK technique T1059.007 indicates it operates as a server-side script injection attack that leverages the web server's response handling mechanisms.
Organizations should immediately upgrade to Apache versions 2.0.43 or later and 1.3.26 or later to address this vulnerability. The recommended mitigation involves enabling proper canonical name handling by setting UseCanonicalName to "On" or "Full" when possible, though this may require careful consideration of existing DNS configurations. Administrators should also implement proper input validation and output sanitization for all HTTP headers, particularly the Host header, in custom error pages. Additional protective measures include implementing Content Security Policy headers to limit script execution, monitoring for unusual Host header patterns, and ensuring that wildcard DNS configurations are properly secured. Network segmentation and web application firewalls can provide additional layers of protection while the primary upgrade is being implemented. The vulnerability demonstrates the critical importance of proper error handling and input sanitization in web server configurations, as even default error pages can become attack vectors when not properly secured against malicious input.