Is there any security vulnerability if I turn on the wildcard?

Hello.

I am using hosting at Cafe24. However, we need a subdomain, so the code below in .htaccess (from the community)

<ifmodule mod_rewrite.c>
RewriteEngine On
RewriteBase /

RewriteCond %{HTTP_HOST} ^abc.kr$ [NC]
RewriteRule ^(.*)$ http://www.abc.kr/$1 [R=301,L]

#RewriteCond %{HTTP_HOST} ^www.abc.kr [NC]
#RewriteRule ^(.*)$ http://abc.kr/$1 [R=301,L]
# Do not use ww subdomain

RewriteCond %{HTTP_HOST} ^ Folder name.abc.kr [NC]
RewriteCond$1!^ (folder name)/
RewriteRule^(.*)$/folder name/$1 [L]
# design subdomains associate folder directories

RewriteCond %{HTTP_HOST} ^ Folder name.abc.kr [NC]
RewriteCond$1!^ (folder name)/
RewriteRule^(.*)$/folder name/$1 [L]
# m subdomains associate folder directories

</ifmodule>

I'm going to use this code after making an inquiry to Cafe24 just in case it's a problem.

Below is the answer.

Hi, everyone. This is Cafe24 Hosting Center.

If you add a phrase and connect it to a specific folder when you connect to a domain, There are no separate billing costs or service restrictions.

However, if it affects the server's load and other user accounts, it may be a service restriction, and it may affect the server's load and other user accounts If it doesn't affect you, you can add a phrase and implement it to connect to a specific folder.

However, the server environment you are using is confirmed to be php7.3 and the version module is rewritten as applied by the customer 301 There is a loop-out problem when applying redirect.

If you need to apply 301 Redirect, you need to change the php version to 7.0 and review the use.

If you need to use it in php7.3, please refer to the example syntax below and implement it. Please note that the example syntax below is for redirecting to https when accessing http. -Example Source-

RewriteEngine on

RewriteCond %{HTTP_HOST} ^www.(.*)$ [NC]

RewriteRule ^(.*)$ http://%1%{REQUEST_URI} [R=302,QSA,NC,L]

* In addition, to connect subdomains to specific folders, it is possible when the subdomains are connected to hosting If you want to create multiple subdomains and use them, you need to change the wildcard setting to ON Phishing mail and phishing sites using wildcard domains are on the rise recently. As a result, the Cafe24 hosting service allows only the domain to which the customer is connected and wwwww.domain . We can allow you to access wildcards, but please review again to see if it is necessary for your safety. If you are abused as a phishing site due to a vulnerability on the website or exposure to an FTP account after allowing wild card access, wild card support may not be possible in the future.**

If you need to set up a wild card even after checking the above, please submit the contents below on the 1:1 inquiry board.

[Request wildcard acceptance]

" I have checked all the wildcard precautions and agree to all of them. "

If you have any other questions, please feel free to contact us on the bulletin board. I will guide you sincerely.

Thank you.

I think they're asking you to consider it because there's a wild card vulnerability Can you explain to me what vulnerabilities you have and how you're going to be robbed and how you're going to defend yourself...?

Thank you :)