cross-site scripting my VirtualHosts

Hi list,

I host a few custom web applications (CRM, case management) using mod_perl. I use a virtual host for each, served by the appropriate perl modules. These applications are accessed by users with the url https://application/base/login

Besides these, I also host a personal web site, also served by mod_perl. I would access this personal site with the url http://personalsite/carnet for my address book, for instance, because I neglected to configure https/port 443 in personalsite.conf.

So, /etc/apache2/sites-enabled looks like :
application_1.conf
application_2.conf
application_3.conf
personalsite.conf

It appears that if one types http://personalsite/base/login in his browser's address bar (this url does not exist in personalsite, only in application_1/2/3), mod_perl will serve the pages of the first custom web application in apache2/sites-enabled. 

Configuring <VirtualHost *:443> in personalsite.conf, even in the absence of PerlModule, SetHandler... directives, disables this, one gets a 500 response in this case.

I found out about this doing some log watching. Someone actually tried that on my site.

Not sure if it's Apache or mod_perl related, but I thought I'd mention it.


--
					Bien à vous, Vincent Veyron 

https://marica.fr/ 
Logiciel de suivi des contentieux juridiques, des sinistres d'assurance et des contrats