Eighteen ways to write one filename
Nineteen requests arrived for a web server configuration file, written eighteen different ways. Trailing tabs, vertical tabs, form feeds, file and record separators, a non-breaking space, a semicolon, and long hex strings glued to the end. Every variant is a different string, so a rule matching the exact filename does not fire, while a permissive path handler may still resolve them to the same file. The gap between what the filter compares and what the filesystem opens is the entire technique.
Nineteen requests this week for one configuration file, written eighteen different ways.
Blocking by filename feels solid. You know the name of the file you are protecting, so you write a rule that matches it.
Here is what arrives. One variant hides the file under a repository folder and appends a suffix. The rest end in characters you cannot type by accident: a tab, a vertical tab, a form feed, and four separator characters that no keyboard produces.
Every one of those is a different string. A rule comparing against the exact name does not fire on any of them.
Whether they resolve to the same file depends entirely on what handles the path afterwards, and that is the bet being placed eighteen times.
A filter compares text. A filesystem opens a file. Anywhere those two disagree is where somebody is already looking.
Normalise the path first, then decide what to block.
#linux#security#selfhosted#infosec#webdev
❯ Normalise the path first, then decide what to block.