Patched Apache flaw is a serious threat for web hosting providers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0211 | Use-After-Free Root Local Privilege Escalation in Apache HTTP Server 2.4 In Apache HTTP Server 2.4 releases 2.4.17 through 2.4.38, a use-after-free flaw (CWE-416) in scoreboard handling allows code running in less-privileged child processes or threads — including in-process scripting interpreters such as mod_php — to execute arbitrary code with the privileges of the parent process, which is usually root. All three standard multi-processing modules (event, worker, and prefork) are affected on Unix-like systems; non-Unix systems such as Windows are not affected. An attacker who can already run code inside the web server process, for example a shared-hosting customer running PHP, gains root privileges on the host, putting every site and service on that server at risk. The flaw is rated 7.8 (high), a public proof-of-concept exploit known as 'Carpe Diem' has been released, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild; EPSS puts the 30-day exploitation probability at 65% (99th percentile). Public scans reported in news coverage counted more than 2 million Apache HTTP servers running affected versions, with shared web hosting environments highlighted as most at risk. Do: Upgrade Apache HTTP Server to a fixed release (2.4.39 or later) or apply patched packages from your OS/vendor — Apache, Fedora, Canonical/Ubuntu, Debian, openSUSE, NetApp, Red Hat, and Oracle have shipped fixes — as required by the CISA KEV catalog. Prioritize internet-facing and shared-hosting servers that run in-process scripting such as mod_php, and verify the running version (e.g. 'apachectl -v' or 'httpd -v') is outside the 2.4.17–2.4.38 range. Note that Windows and other non-Unix installations are not affected. | 7.8 | 65% | KEV PoC ×2 |
| mass≈2,000,000+ Apache HTTP servers running affected 2.4.17–2.4.38 releases (subset requiring local code-execution access, e.g. shared hosts) |
Full article315 words · extracted from helpnetsecurity.com · click to collapse
Organizations running Apache web servers are urged to implement the latest security update to fix a serious privilege escalation flaw (CVE-2019-0211) that can be triggered via scripts and could allow unprivileged web host users to execute code with root privileges, i.e. allow them to gain complete control of the machine.
About CVE-2019-0211
Discovered by security researcher Charles Fol and dubbed Carpe Diem, the vulnerability affects only Apache HTTP Server on Unix systems.
“In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard,” the Apache Software Foundation shared.
Fol’s write-up goes into more detail but does not contain PoC exploit code. “The exploit will be disclosed at a later date,” he said, so admins have time to implement the security update (Apache httpd v2.4.39).
Mark Cox, one of the founders of the Apache Software Foundation, singled out the vulnerability in his call for a quick implementation of the update.
“[The flaw] allows anyone you allow to write a script (PHP, CGI,..) to gain root. Get 2.4.39 *now* especially if you have untrusted script authors or run shared hosting (or use mod_auth_digest, due to a separate flaw),” he advised.
That's one attack yes. It's also common to give unprivileged users the ability to write their own scripts (common in shared hosting, but also other environments) and this would allow them to get root.
— Mark J Cox (@iamamoose) April 2, 2019
While plugging this hole quickly is a must for web hosting providers, whose servers are usually shared by various users, all Apache admins should implement the update as soon as possible, as CVE-2019-0211 could be exploited in conjuction with other flaws to achieve root access.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/04/03/apache-web-server-cve-2019-0211/