Apache HTTP Server Reverse Proxy/Rewrite URL Validation Issue | Qualys
Summary: Qualys researcher discovered CVE-2011-4317, a reverse proxy URL validation flaw that survived the patch for the earlier CVE-2011-3368, and Apache made the issue public after receiving the advisory and proof of concept. The CVE-2011-3368 patch in server/protocol.c returned HTTP 400 for URLs not beginning with a forward slash but did not process URIs carrying a scheme, so a crafted request such as GET @localhost::8880 HTTP/1.0 reached an internal Tomcat instance on port 8880, and Apache fixed the issue in version 2.2.22.
Key Takeaway: A fully patched Apache 2.2.21 with the CVE-2011-3368 fix applied was still exploitable, so a version number alone did not prove the reverse proxy was safe. The exposure hinged on RewriteRule or ProxyPassMatch directives missing a forward slash before $1, which let an internet request reach internal systems.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2011-3368CVE-2011-4317
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026