The Truth about GET and HTTP Standards, (Tue, Sep 22nd)
A recent test revealed that several web servers, including Apache and NGINX, are now accepting GET requests with a body, a feature not traditionally supported by the HTTP standard. This behavior could potentially be exploited, though currently it's not a critical vulnerability. The test highlighted that while some servers accept the body, others simply ignore it and proceed with a 200 response.
A recent test by the SANS Internet Storm Center highlighted a surprising behavior in several web servers. The test involved sending a GET request with a body to common web servers like Apache 2.4.68 and NGINX. The goal was to determine how these servers handled this atypical request.
Apache 2.4.68 successfully accepted the body, returning a 200 OK status and a response containing the data. The test utilized a modified version of a standard ‘test-cgi’ script to send the body. The server processed the request and returned a complete response.
NGINX, on the other hand, did not accept the body. Instead, it immediately sent a 301 Moved Permanently response, effectively ignoring the body. A simple Python web server also exhibited similar behavior, sending a 200 response without processing the body.
Johannes B. Ullrich, Dean of Research at SANS.edu, posed the question to the community about other web servers to test this behavior. This finding underscores a potential deviation from HTTP standards and raises questions about how this might be leveraged in future attacks or misconfigurations.