Apache fixes actively exploited web server zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-41773 | Path Traversal to RCE in Apache HTTP Server 2.4.49 Apache HTTP Server contains a path traversal flaw (CWE-22) that lets crafted HTTP requests reach files outside directories configured via Alias-like directives. When files outside those aliased directories are not protected by the default 'require all denied' policy, attackers can read arbitrary files outside the intended root, and if CGI scripts are enabled the traversal can be escalated to remote code execution under the web server account. Anyone running an affected Apache HTTP Server release with such a configuration is exposed; the initial 2.4.50 patch was incomplete, so the flaw's full remediation is tracked under CVE-2021-42013. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days (100th percentile). Do: Upgrade to Apache HTTP Server 2.4.51 or later; do not stop at 2.4.50, since its fix was incomplete (see CVE-2021-42013). As an interim mitigation, ensure directories referenced by Alias-like directives are covered by 'require all denied' and disable or restrict CGI (mod_cgi/mod_cgid) on traversable paths. Review access logs for traversal patterns such as /icons/../ and unexpected CGI invocations, and hunt for webshells or ransomware staging given the known ransomware use. | 9.8 | 100% | KEV ransomware PoC ×6 |
| masson the order of 100,000+ internet-exposed Apache servers |
Full article312 words · extracted from therecord.media · click to collapse
The Apache Software Foundation has released on Monday a security patch to address a vulnerability in its HTTP Web Server project that has been actively exploited in the wild. Tracked as CVE-2021-41773, the vulnerability affects only Apache web servers running version 2.4.49 and occurs because of a bug in how the Apache server converts between different URL path schemes (a process called path or URI normalization). "An attacker could use a path traversal attack to map URLs to files outside the expected document root," the ASF team said in the Apache HTTP Server 2.4.50 changelog. "If files outside of the document root are not protected by 'require all denied' these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts," Apache engineers added. Attacks exploiting this bug were spotted by Ash Daulton along with the cPanel Security Team, both of which reported the issue to the Apache team. Hours after the 2.4.50 version was released, several security researchers were able to reproduce the vulnerability and release multiple proof-of-concept exploits on Twitter and GitHub. Just got worked exploit PoC for path traversal in Apache HTTP Server 2.4.49 (CVE-2021-41773) with my collab again @yabeow #bugbountytips pic.twitter.com/oGHtbWwKHT We have reproduced the fresh CVE-2021-41773 Path Traversal vulnerability in Apache 2.4.49. If files outside of the document root are not protected by "require all denied" these requests can succeed. Patch ASAP! https://t.co/6JrbayDbqG pic.twitter.com/AnsaJszPTE Currently, the Apache HTTP Server is either #1 or #2 on the list of today's most used web servers, with more than 120,000 servers currently exposed online to attacks. The good news is that not all run the latest version, and administrators can easily mitigate the zero-day attacks by skipping the 2.4.49 version and upgrading to 2.4.50 directly.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/apache-fixes-actively-exploited-web-server-zero-day