CVE-2013-5704: Medium severity Apache HTTP Server vulnerability
Martin Holst Swende discovered a flaw in the way modheaders handled chunked requests. A remote attacker could use this flaw to bypass intended modheaders restrictions, allowing them to send requests to applications that include headers that should have been removed by modheaders.
Discussion and a possible patch is available from the following thread:
http://marc.info/?t=138219209900002&r=1&w=2
References:
http://martin.swende.se/blog/HTTPChunked.html
Other sources
The modheaders module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5704?
CVE-2013-5704 is considered a low-severity vulnerability as the vendor has stated it is not a security issue in Apache HTTP Server.
How do I fix CVE-2013-5704?
To mitigate CVE-2013-5704, upgrade to Apache HTTP Server version 2.2.29 or 2.4.11 or later.
What versions of Apache HTTP Server are affected by CVE-2013-5704?
CVE-2013-5704 affects Apache HTTP Server versions 2.2.22 and earlier, including various other specified versions.
Can CVE-2013-5704 lead to remote code execution?
No, CVE-2013-5704 does not lead to remote code execution but allows for header manipulation.
Is CVE-2013-5704 a exploitation risk to my server?
The risk from CVE-2013-5704 is limited; however, it can be leveraged in specific scenarios to bypass security headers.