![[Updated, again] Apache fixes zero-day vulnerability in HTTP Server](https://www.malwarebytes.com/wp-content/uploads/sites/2/2021/10/no_access.png?w=1200)
The Apache HTTP Server 2.4.49 is vulnerable to a flaw that allows attackers to use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by “require all denied” these requests can succeed. This issue is known to be exploited in the wild.
The vulnerability
The Apache HTTP Server Project started out as an effort to develop and maintain an open-source HTTP server for modern operating systems, including UNIX and Windows. It provides a secure, efficient, and extensible server that provides HTTP services in sync with the current HTTP standards.
The flaw (listed as CVE-2021-41773) was introduced by a change made to path normalization in Apache HTTP Server 2.4.49. So, earlier versions are not vulnerable, nor are servers that are configured to “require all denied”.
Unfortunately, “require all denied” is off in the default configuration. This is the setting that typically shows an error that looks like this:
“Forbidden. You don’t have permission to access {path}.”
Path traversal attack
Path traversal attacks are done by sending requests to access backend or sensitive server directories that should be out of reach for unauthorized users. While normally these requests are blocked, the vulnerability allows an attacker to bypass the filters by using encoded characters (ASCII) for the URLs.
Using this method an attacker could gain access to files like cgi scripts that are active on the server, which could potentially reveal configuration details that could be used in further attacks.
Impact
The Apache HTTP Server Project was launched in 1995, and it’s been the most popular web server on the Internet since April 1996. In August 2021 there were some 49 million active sites running on Apache server. Obviously we do not know which server every domain is using, but of the sites where we can identify the web server, Apache is used by 30.9%.
A Shodan search by Bleeping Computer showed that there are over a hundred thousand Apache HTTP Server 2.4.49 deployments online, many of which could be vulnerable to exploitation.
Security researchers have warned that admins should patch immediately.
Another vulnerability
There’s a second vulnerability tackled by this patch—CVE-2021-41524—a null pointer dereference detected during HTTP/2 request processing. This flaw allows an attacker to perform a denial of service (DoS) attack on the server. This requires a specially crafted request.
This flaw also only exists in Apache Server version 2.4.49, but is different to the first vulnerability in that, as far as we know, it is not under active exploitation. It was discovered three weeks ago, fixed late last month, and incorporated now in version 2.4.50.
Mitigation
All users should install the latest version as soon as possible, but:
- Users that have not installed 2.4.49 yet should skip this version in their update cycle and go straight to 2.4.50.
- Users that have 2.4.49 installed should configure “require all denied” if they do not plan to patch quickly, since this blocks the attack that has been seen in the wild.
A full list of vulnerabilities in Apache HTTP Server 2.4 can be found here.
Update, October 8
Apache has issued a new patch. According to the release notes for version 2.4.51…
…the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives.
The new part of the vulnerability is listed under CVE-2021-42013. The “require all denied” setting blocks attacks using this vulnerability as well. Time to patch the patch.
Stay safe, everyone!
