.htaccess Generated from a Python Share App

The vulnerable code is Python, but the sink is Apache configuration. User-controlled data embedded into a generated .htaccess crosses a trust boundary into a parser with its own escaping and continuation rules. Apache treats trailing backslashes as line continuation and honors injected directives if newlines survive into the file.

Why It Works

• Python validates loosely (e.g. an IP "looks valid") then reuses the original user string rather than the normalized parsed object.

Vulnerable Pattern

• A "share note" feature writing .htaccess lines (filename restrictions, IP allowlists) via direct string interpolation.
• Loose IP validation followed by reuse of the raw user string.

Exploit Flow

1. Inspect the .htaccess template shape (from source, or infer it from errors and behavior changes).
2. Try to eat or merge a defense line first with a trailing backslash, then graduate to explicit newline directive injection.
3. Once Apache behavior is influenced, decide between broader access, header oracles, handler reconfiguration, or server-side includes.

Variations

• IPv6 zone IDs, shared note names ending in \, %0aRequire all granted, %0aHeader set ..., or comment/escaping tricks.

Common Blockers

• Apache may reject a malformed .htaccess entirely, causing 500s instead of a usable partial config.

PoC Sketch

# share name ending with a backslash, or:
fe80::1%0aRequire all granted%0aHeader set X-Test yes
# then fetch the generated shared note

Good Situations To Use It

• A Python app writes per-share .htaccess from user input.
• IP/filename validation is loose and reuses the raw string.
• The shared directory is served by Apache with AllowOverride enabled.

Sources

• fcsc2026/web/secure_mood_notes_1
• fcsc2026/web/secure_mood_notes_2/part_1