Apache patch a zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-41773 +1 in the same advisory: …41524 | Path Traversal to RCE in Apache HTTP Server 2.4.49 Apache HTTP Server contains a path traversal flaw (CWE-22) that lets crafted HTTP requests reach files outside directories configured via Alias-like directives. When files outside those aliased directories are not protected by the default 'require all denied' policy, attackers can read arbitrary files outside the intended root, and if CGI scripts are enabled the traversal can be escalated to remote code execution under the web server account. Anyone running an affected Apache HTTP Server release with such a configuration is exposed; the initial 2.4.50 patch was incomplete, so the flaw's full remediation is tracked under CVE-2021-42013. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days (100th percentile). Do: Upgrade to Apache HTTP Server 2.4.51 or later; do not stop at 2.4.50, since its fix was incomplete (see CVE-2021-42013). As an interim mitigation, ensure directories referenced by Alias-like directives are covered by 'require all denied' and disable or restrict CGI (mod_cgi/mod_cgid) on traversable paths. Review access logs for traversal patterns such as /icons/../ and unexpected CGI invocations, and hunt for webshells or ransomware staging given the known ransomware use. | 9.8 group max | 100% | KEV ransomware PoC ×6 |
| masson the order of 100,000+ internet-exposed Apache servers |
Full article336 words · extracted from securityaffairs.com · click to collapse
Apache has addressed two vulnerabilities, one of which is a path traversal and file disclosure flaw in its HTTP server actively exploited in the wild.
Apache has rolled out security patches to address two flaws, including a path traversal and file disclosure issue in its HTTP server that is actively exploited in the wild.
The two vulnerabilities have been tracked as CVE-2021-41773 and CVE-2021-41524.
The first issue, tracked as CVE-2021-41773, is a path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49. An attacker can trigger the flaw to map URLs to files outside the expected document root.
“A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root.” reads the advisory. “If files outside of the document root are not protected by “require all denied” these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts.”
The vulnerability affects only Apache 2.4.49, earlier versions are not impacted. The vulnerability was reported by Ash Daulton along with the cPanel Security Team. According to the advisory, the issue is known to be exploited in the wild.
Apache also addressed a null pointer dereference in HTTP/2 fuzzing tracked as CVE-2021-41524.
“While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request.” reads the advisory.
An attack can trigger the flaw to perform a denial-of-service (DoS) attack on the server.
The flaw was recently introduced in version 2.4.49.
Users are recommended to install the patches immediately, a growing number of threat actors could start exploiting the flaw in the coming weeks.
Security experts at Positive Technologies announced to have already reproduced the CVE-2021-41773 flaw.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Apache)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/122999/hacking/apache-zero-day-flaw.html