Apache Httpd < None: Tampering of mod_session data for CGI applications

2017-11-14T00:00:00
ID HTTPD:2E568217BC35E0AA91DF49E7CE65CA67
Type httpd
Reporter The issue was discovered internally by the Apache HTTP Server team.
Modified 2018-03-21T00:00:00

Description

When mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications. The severity is set to Moderate because "SessionEnv on" is not a default nor common configuration, it should be considered more severe when this is the case though, because of the possible remote exploitation.