Patch Apache HTTP Servers Now to Avoid Zero Day Exploit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-41773 +1 in the same advisory: …41524 | Path Traversal to RCE in Apache HTTP Server 2.4.49 Apache HTTP Server contains a path traversal flaw (CWE-22) that lets crafted HTTP requests reach files outside directories configured via Alias-like directives. When files outside those aliased directories are not protected by the default 'require all denied' policy, attackers can read arbitrary files outside the intended root, and if CGI scripts are enabled the traversal can be escalated to remote code execution under the web server account. Anyone running an affected Apache HTTP Server release with such a configuration is exposed; the initial 2.4.50 patch was incomplete, so the flaw's full remediation is tracked under CVE-2021-42013. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days (100th percentile). Do: Upgrade to Apache HTTP Server 2.4.51 or later; do not stop at 2.4.50, since its fix was incomplete (see CVE-2021-42013). As an interim mitigation, ensure directories referenced by Alias-like directives are covered by 'require all denied' and disable or restrict CGI (mod_cgi/mod_cgid) on traversable paths. Review access logs for traversal patterns such as /icons/../ and unexpected CGI invocations, and hunt for webshells or ransomware staging given the known ransomware use. | 9.8 group max | 100% | KEV ransomware PoC ×6 |
| masson the order of 100,000+ internet-exposed Apache servers |
Full article281 words · extracted from infosecurity-magazine.com · click to collapse
Apache HTTP Server users have been urged to immediately patch after it emerged that a zero-day vulnerability in the popular open-source software is being exploited in the wild.
CVE-2021-41773 is described as a path traversal flaw in version 2.4.49, which was itself only released a few weeks ago.
“An attacker could use a path traversal attack to map URLs to files outside the expected document root,” a description of the bug noted. “If files outside of the document root are not protected by ‘require all denied’ these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts.”
According to Sonatype senior security researcher, Ax Sharma, there are around 112,000 Apache servers across the globe running version 2.4.49, two-fifths of which are located in the US.
He argued that the new zero-day exploit highlights that, even when a vendor releases patches, they may subsequently be bypassed.
On that point, Google research earlier this year claimed that a quarter of zero-day exploits could have been avoided if vendors had taken more time over patching. It noted that 25% of zero-days spotted in 2020 were closely related to previously publicly disclosed vulnerabilities.
The new Apache HTTP Server Version 2.4.50 also includes a fix for a denial of service vulnerability, CVE-2021-41524, discovered a few weeks ago but not thought to have been actively exploited.
Sonatype’s Sharma also warned that unpatched Apache Airflow servers at dozens of tech firms were leaking thousands of credentials and configuration secrets due to poor configuration and security practices.
“Most of these issues could have been avoided by simply upgrading Airflow to version 2, which comes with extensive improvements and security enhancements,” he argued.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/patch-apache-http-servers-now-zero/