Apache fixed a couple of severe vulnerabilities in Apache HTTP Server
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-40438 | Server-Side Request Forgery (SSRF) in Apache HTTP Server mod_proxy CVE-2021-40438 is a server-side request forgery flaw (CWE-918) in the mod_proxy module of Apache HTTP Server 2.4.48 and earlier. By sending a crafted request URI path, a remote attacker can cause the server to forward the request to an origin server chosen by the attacker instead of the intended backend. This lets the attacker use the web server as a proxy to reach internal network services, probe internal hosts, and bypass network access controls. Anyone running an affected Apache HTTP Server version with mod_proxy enabled in a proxying configuration is affected. The flaw is being actively exploited in the wild - it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-12-01 with known ransomware use - and EPSS assigns it the highest probability of near-term exploitation. Do: Upgrade Apache HTTP Server to a release newer than 2.4.48 per vendor instructions. As an interim mitigation, restrict mod_proxy so it forwards only to explicitly configured backends (avoiding attacker-controlled origin selection) or disable mod_proxy where it is not required, and audit internet-facing Apache servers for proxy configurations. Because this flaw is on the CISA KEV list with known ransomware use, prioritize patching internet-facing systems immediately. | 9.0 | 100% | KEV ransomware |
| masshundreds of thousands of internet-facing Apache HTTP Server instances (only the mod_proxy-enabled subset is vulnerable) | |
| CVE-2021-44790 +1 in the same advisory: …44224 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier. NVD description · AI analysis pending | 9.8 group max | 97% | PoC |
| — |
Full article323 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 27, 2021
The Apache Software Foundation released Apache HTTP Server 2.4.52 to address a couple of security flaws that can lead to remote code execution.
The Apache Software Foundation has released the Apache HTTP Server 2.4.52 to address a couple of vulnerabilities, tracked as CVE-2021-44790 and CVE-2021-44224, that can lead to remote code execution attacks.
The CVE-2021-44790 is a possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier. The Apache httpd team is not aware of attacks in the wild exploiting this vulnerability.
“A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).” reads the advisory published by the foundation.
The second flaw, tracked as CVE-2021-44224, is a possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier.
“A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery).” continues the advisory.
The Apache httpd team is not aware of an exploit for the vulnerability though it might be possible to craft one.
US CISA recommends users and administrators review the Apache announcement and update their installs as soon as possible.
“The Apache Software Foundation has released Apache HTTP Server 2.4.52. This version addresses vulnerabilities—CVE-2021-44790 and CVE-2021-44224—one of which may allow a remote attacker to take control of an affected system.” reads the advisory published by CISA.
In November, Germany’s Federal Office for Information Security (BSI) and Cisco warned threat actors are exploiting another server-side request forgery (SSRF) vulnerability, tracked as CVE-2021-40438, in HTTP servers.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Apache)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/126077/security/apache-http-server-flaws.html