AI analysis
Apache HTTP Server’s mod_auth_digest has an authentication bypass by capture-replay (CWE-294) on all platforms. A man-in-the-middle attacker who has already captured digest authentication credentials can replay them using crafted requests that force garbage collection of the client’s shared-memory entry, but only when AuthDigestNonceLifetime is set to 0. A successful replay lets the attacker authenticate as that client without knowing the password. Apache HTTP Server 2.4.x is affected in that configuration; version 2.4.69 fixes the issue. No public proof-of-concept is known, and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog.
What to do: Upgrade Apache HTTP Server to 2.4.69. Until that is possible, do not set AuthDigestNonceLifetime to 0, or stop using mod_auth_digest and prefer a stronger authentication method over TLS. Review configs for digest authentication, since exploitation also requires a man-in-the-middle position on the client path.
Affected
| Apache Software Foundation Apache HTTP Server | 2.4.x before 2.4.69 |
Estimated exposure
masstens of millions of Apache 2.4 installations contain the code; the exploitable subset (digest auth with AuthDigestNonceLifetime 0) is unknown — Public web surveys such as W3Techs and Netcraft have long shown Apache HTTP Server on a large share of websites, on the order of tens of millions of installations on the 2.4 line; there is no public count of sites that enable…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.