CVE-2002-1157 in mod_ssl
Summary
by MITRE
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2025
The vulnerability described in CVE-2002-1157 represents a critical cross-site scripting flaw within the mod_ssl Apache module version 2.8.9 and earlier. This security weakness specifically manifests when the Apache server operates with UseCanonicalName directive disabled and has wildcard DNS configuration enabled. The flaw enables remote attackers to inject malicious scripts that execute in the context of other website visitors, creating a significant threat to web application security and user privacy.
The technical exploitation of this vulnerability occurs through manipulation of the server name within HTTPS responses on the SSL port. When UseCanonicalName is set to off, Apache does not canonicalize the server name, allowing attackers to craft malicious responses that contain self-referencing URLs. These URLs are then processed by browsers in a manner that executes the injected scripts against other users who visit the affected website. The vulnerability differs from CAN-2002-0840 in that it specifically targets the SSL port handling and URL construction process rather than general HTTP response manipulation.
The operational impact of this vulnerability extends beyond simple script execution, as it allows attackers to potentially steal session cookies, perform unauthorized actions on behalf of users, and compromise the integrity of web applications. The combination of mod_ssl module weakness with specific Apache configuration settings creates a perfect storm for exploitation. The presence of wildcard DNS further amplifies the attack surface, as it allows attackers to leverage the vulnerability across multiple subdomains without needing to know specific domain names in advance.
Security practitioners should note that this vulnerability aligns with CWE-79 which categorizes cross-site scripting flaws, and it demonstrates characteristics consistent with techniques documented in ATT&CK framework under T1566 for initial access through web application attacks. The vulnerability highlights the importance of proper Apache configuration management and the dangers of enabling features like wildcard DNS without adequate security controls. Organizations should immediately upgrade to mod_ssl versions beyond 2.8.9 and ensure UseCanonicalName is properly configured to prevent this class of attack from succeeding. Additionally, implementing proper input validation and output encoding mechanisms within web applications can provide defense-in-depth against similar vulnerabilities that might exist in other components of the web stack.