AI analysis
Apache HTTP Server’s mod_proxy_ftp does not properly validate the address in an FTP server’s PASV reply. In a forward-proxy configuration, an untrusted FTP server can return a crafted PASV response that makes the proxy open its data connection to an arbitrary third-party host rather than back to that FTP server. An attacker who can have the proxy retrieve from a malicious FTP server can abuse it to reach internal or external hosts chosen by the attacker (an FTP bounce / proxy-connection abuse issue), not to run code on the proxy itself. All platforms running Apache HTTP Server through 2.4.68 with mod_proxy_ftp as a forward proxy are affected; 2.4.69 fixes the check. It is not on the CISA KEV list, has no CVSS score yet, and no public proof-of-concept is known.
What to do: Upgrade Apache HTTP Server to 2.4.69 or later. Until then, disable mod_proxy_ftp or stop using it as a forward proxy to untrusted FTP servers, and review ProxyRequests and any FTP proxy rules so the server cannot be induced to open data connections to arbitrary hosts.
Affected
| Apache Software Foundation Apache HTTP Server | through 2.4.68 (all platforms); fixed in 2.4.69 |
Estimated exposure
nicheunknown; likely a small niche subset of Apache installs (forward proxies with mod_proxy_ftp), not the full server population — Apache HTTP Server is deployed on millions of sites, but this flaw applies only where mod_proxy_ftp is used as a forward proxy, a much less common configuration than reverse-proxy or origin-server installs, with no public scan count of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.