More than 2 million Apache HTTP servers affected by CVE-2019
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0211 | Use-After-Free Root Local Privilege Escalation in Apache HTTP Server 2.4 In Apache HTTP Server 2.4 releases 2.4.17 through 2.4.38, a use-after-free flaw (CWE-416) in scoreboard handling allows code running in less-privileged child processes or threads — including in-process scripting interpreters such as mod_php — to execute arbitrary code with the privileges of the parent process, which is usually root. All three standard multi-processing modules (event, worker, and prefork) are affected on Unix-like systems; non-Unix systems such as Windows are not affected. An attacker who can already run code inside the web server process, for example a shared-hosting customer running PHP, gains root privileges on the host, putting every site and service on that server at risk. The flaw is rated 7.8 (high), a public proof-of-concept exploit known as 'Carpe Diem' has been released, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild; EPSS puts the 30-day exploitation probability at 65% (99th percentile). Public scans reported in news coverage counted more than 2 million Apache HTTP servers running affected versions, with shared web hosting environments highlighted as most at risk. Do: Upgrade Apache HTTP Server to a fixed release (2.4.39 or later) or apply patched packages from your OS/vendor — Apache, Fedora, Canonical/Ubuntu, Debian, openSUSE, NetApp, Red Hat, and Oracle have shipped fixes — as required by the CISA KEV catalog. Prioritize internet-facing and shared-hosting servers that run in-process scripting such as mod_php, and verify the running version (e.g. 'apachectl -v' or 'httpd -v') is outside the 2.4.17–2.4.38 range. Note that Windows and other non-Unix installations are not affected. | 7.8 | 65% | KEV PoC ×2 |
| mass≈2,000,000+ Apache HTTP servers running affected 2.4.17–2.4.38 releases (subset requiring local code-execution access, e.g. shared hosts) |
Full article410 words · extracted from securityaffairs.com · click to collapse
Security experts at Rapid7 have discovered that over 2 million Apache HTTP servers are still affected by the CVE-2019-0211 critical privilege escalation flaw.
An important privilege escalation vulnerability (CVE-2019-0211) affecting the Apache HTTP server could be exploited by users with the right to write and run scripts to gain root on Unix systems via scoreboard manipulation.
The flaw was discovered by Charles Fol and impacts all Apache HTTP Server releases from 2.4.17 to 2.4.38. The it has been addressed with the release of Apache httpd 2.4.39
“In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.” reads the changelog.
The CVE-2019-0211 vulnerability poses severe risks when the web server is used for running shared hosting instances, in this scenario, users with limited permissions could exploit the flaw to get root privileges using scripts and run commands on vulnerable Apache web servers.
Unfortunately, the vulnerability in Apache HTTP Server has been found and patched, but the sheer still impacts a large number of servers running older, unpatched versions. Hundreds of thousands of websites and servers could still be potentially exposed to cyber attacks exploiting the issue.
According to an analysis conducted by Rapid7, more than 2,000,000 servers, many on public cloud platforms, are still running vulnerable versions of Apache. Most of the flawed systems are in the United States (~770,000), Germany (~224,000), and France (~111,000).
“We found roughly 2 million distinct systems vulnerable to CVE-2019-0211 in our most recent HTTP scans, with 50% of them residing in the “usual suspects” (big cloud-hosting providers).” states the blog post published by Rapid7,
Even if the CVE-2019-0211 is not a remote code execution (RCE) vulnerability, it represents a serious threat to shared hosting providers that run multiple websites under the sale Apache process.
“Organizations should consider applying Apache’s fix as soon as possible. And, if organizations host their website(s) in a shared hosting context impacted by this exposure, they should encourage their provider to patch as quickly as possible or consider moving to a different provider/platform.” suggests Rapid7.
At the time, Rapid7 Labs is not aware of any exploitation of this vulnerability
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – CVE-2019-0211, Apache)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/83358/hacking/cve-2019-0211-apache-flaw.html