Apache Open Redirect

Bonjour,
Je suis à la recherche d'une solution afin de corriger la faille Open Redirect, ci-dessous mes deux fichiers de conf Apache:

Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 
<VirtualHost *:80>
        ServerName test.be
        ServerAdmin me@test.be
        DocumentRoot /var/www/html
 
        # Rewrite rule to redirect to https
        RewriteEngine On
        RewriteCond %{HTTPS} !=on
        RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [L,R=301,NC]
 
        ErrorDocument 404 /error_pages/error.html
 
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
 
<IfModule mod_ssl.c>
        <VirtualHost  *:443>
                ServerAdmin me@test.be
                ServerName test.be
 
                DocumentRoot /var/www/html
 
                ErrorLog ${APACHE_LOG_DIR}/error.log
                CustomLog ${APACHE_LOG_DIR}/access.log combined
 
                ErrorDocument 404 /error_pages/error.html
 
 
                SSLCertificateFile /etc/ssl/certs/server.crt
                SSLCertificateKeyFile /etc/ssl/private/server.key
 
                SSLProtocol -ALL +TLSv1 +TLSv1.1 +TLSv1.2
                SSLHonorCipherOrder On
                SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:HIGH:!MD5:!aNULL:!EDH:!RC4
                SSLCompression off
 
        </VirtualHost>
</IfModule>

Ceci en place lors du test à l'aide de Nmap, j'ai toujours la redirection possible, donc vulnérable au phishing:

Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
root@server:/usr/share/nmap/scripts# curl -ik "http://xxx.xxx.xxx.xxx"
HTTP/1.1 301 Moved Permanently
Date: Mon, 07 Oct 2019 13:53:32 GMT
Server: Apache
Location: https://xxx.xxx.xxx.xxx/
Content-Length: 229
Content-Type: text/html; charset=iso-8859-1
 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https://xxx.xxx.xxx.xxx/">here</a>.</p>
</body></html>
root@server:/usr/share/nmap/scripts# curl -ik "http://xxx.xxx.xxx.xxx/.pomme.be"
HTTP/1.1 301 Moved Permanently
Date: Mon, 07 Oct 2019 13:53:37 GMT
Server: Apache
Location: https://xxxx.xxx.xxxx.xxx/.pomme.be
Content-Length: 237
Content-Type: text/html; charset=iso-8859-1
 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https://xxx.xxx.xxx.xxx/.pomme.be">here</a>.</p>
</body></html>
root@server:/usr/share/nmap/scripts#

Normalement suite à cette réponse du serveur : "<title>301 Moved Permanently</title>" je devrais avoir un "connection close" comme ci-dessous

Code:

1
2
3
4
5
6
 
root@server:/usr/share/nmap/scripts# curl -ik "http://goodsite.be"
HTTP/1.0 301 Moved Permanently
Connection: close
Strict-Transport-Security:  max-age=31536000
Location: http://goodsite.be

Comment corriger cela ?