PoC exploit for Carpe Diem Apache bug released
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0211 | Use-After-Free Root Local Privilege Escalation in Apache HTTP Server 2.4 In Apache HTTP Server 2.4 releases 2.4.17 through 2.4.38, a use-after-free flaw (CWE-416) in scoreboard handling allows code running in less-privileged child processes or threads — including in-process scripting interpreters such as mod_php — to execute arbitrary code with the privileges of the parent process, which is usually root. All three standard multi-processing modules (event, worker, and prefork) are affected on Unix-like systems; non-Unix systems such as Windows are not affected. An attacker who can already run code inside the web server process, for example a shared-hosting customer running PHP, gains root privileges on the host, putting every site and service on that server at risk. The flaw is rated 7.8 (high), a public proof-of-concept exploit known as 'Carpe Diem' has been released, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild; EPSS puts the 30-day exploitation probability at 65% (99th percentile). Public scans reported in news coverage counted more than 2 million Apache HTTP servers running affected versions, with shared web hosting environments highlighted as most at risk. Do: Upgrade Apache HTTP Server to a fixed release (2.4.39 or later) or apply patched packages from your OS/vendor — Apache, Fedora, Canonical/Ubuntu, Debian, openSUSE, NetApp, Red Hat, and Oracle have shipped fixes — as required by the CISA KEV catalog. Prioritize internet-facing and shared-hosting servers that run in-process scripting such as mod_php, and verify the running version (e.g. 'apachectl -v' or 'httpd -v') is outside the 2.4.17–2.4.38 range. Note that Windows and other non-Unix installations are not affected. | 7.8 | 65% | KEV PoC ×2 |
| mass≈2,000,000+ Apache HTTP servers running affected 2.4.17–2.4.38 releases (subset requiring local code-execution access, e.g. shared hosts) |
Full article270 words · extracted from helpnetsecurity.com · click to collapse
Charles Fol, the security engineer that unearthed the Carpe Diem Apache HTTP Server bug (CVE-2019-0211), has released an exploit for it.
“This is between a POC and a proper exploit. I added tons of comments, it is meant to be educational as well,” he noted, but added that it “might fail for a dozen of reasons.”
Still, it might help attackers to create a more stable one and deploy it in attacks, so admins – and especially those administrating shared hosting environments – would do well to plug the hole if they haven’t already.
About CVE-2019-0211
CVE-2019-0211 and several other vulnerabilities have been patched in Apache HTTP Server v2.4.39, which was released on April 1.
While it is “just” a privilege escalation vulnerability, it can be exploited to gain root access to the server by simply running a script.
As Mark Cox, one of the founders of the Apache Software Foundation, pointed out, it is “common to give unprivileged users the ability to write their own scripts (common in shared hosting, but also other environments) and this would allow them to get root.”
In shared environments, root access would allow attackers to access files shared by other users on the host environment.
In non-shared environments, the flaw still presents a threat as it could be concatenated with other flaws (e.g., a remote code execution bug) to achieve the same goal (root access).
CVE-2019-0211 affects only Apache HTTP Server on Unix systems. Debian, SuSE and Ubuntu have already provided package updates that plug the hole, and so has cPanel. Other affected distributions will likely follow suit very soon.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/04/09/apache-cve-2019-0211-exploit/