Apache reverse proxy gives "Failed to load script info. Try to reload the page. Error message: Failed to reconnect"

[agail]

I'm running all my script-server dockers behind Apache reverse proxy. This worked just fine up to apache2 (2.4.41-4ubuntu3.22) apache2 (2.4.41-4ubuntu3.23) introduced a fix for CVE-2024-38474**

A workaround for this is to alter the rewrite rule for Apache reverse proxy RewriteRule /(.*) ws:/$1 [P,NE] to RewriteRule /(.*) ws:/$1 [P,NE,UnsafeAllow3F]

apache error log: [rewrite:error] [pid 1363] [client 192.168.112.152:57150] AH: Unsafe URL with %3f URL rewritten without UnsafeAllow3F

** Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.

I would rather see a rewrite of the calling url to not encode ? to %3f

[bugy]

Hi @agail thanks a lot for it. I'm not a sysadmin and provided very naive solution for the reverse proxy. Do you know if this new flag (UnsafeAllow3F) is backward compatible? If someone puts it for older apache proxy version, will it be ignored or fail?

I would rather see a rewrite of the calling url to not encode ? to %3f

could you explain what you mean?