Skip to main content

Apache Releases Security Update for Apache HTTP Server 2.4

Security update released to fix vulnerabilities in Apache HTTP Server 2.4.49 and 2.4.50

Threat ID:
CC-3955
Threat Severity:
Medium
Threat Vector:
Vulnerability
Published:
6 October 2021 10:53 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update released to fix vulnerabilities in Apache HTTP Server 2.4.49 and 2.4.50

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 2.4.51

Apache HTTP Server

Threat details

Introduction

Apache has released a security update to address two vulnerabilities in Apache HTTP Server 2.4.49. One of these vulnerabilities, a path traversal and file disclosure vulnerability tracked as CVE-2021-41773, has been rated as 'important' and is known to have been exploited in the wild. The vulnerability was found in a change made to path normalisation, and could allow an attacker to use a path traversal attack to map URLs to files outside the expected document root. This attack could be successful if files outside the document root are not protected by the 'require all denied' access control, and could leak the source of CGI scripts and other interpreted files.

The second vulnerability, a null pointer dereference in h2 fuzzing vulnerability, tracked as CVE-2021-41524, could allow an attacker to carry out a denial-of-service (DoS) attack on the server using a specially crafted request. Apache have rated this vulnerability as 'moderate' and it is not known to have been exploited.

Threat updates

Date Update
3 Dec 2021 Vulnerability, CVE-2021-40438, in Apache 2.4.48 and earlier being actively exploited.

CISA has issued a statement warning of active exploitation of a vulnerability, CVE-2021-40438, affecting Apache HTTP Server 2.4.48 and earlier. Discovered in September 2021, CVE-2021-40438 is a critical vulnerability (CVSS v3 9.0) that can allow a crafted request uri-path to cause mon_proxy to forward the request to an origin server chosen by the remote user. CISA has added CVE-2021-40438 to their Known Exploited Vulnerabilities Catalog.

Affected organisations, running Apache HTTP Server 2.4.48 or earlier, are urged to review the Apache HTTP Server 2.4 security advisory and update to the latest version 2.4.51 - see 'Remediation advice' section below.

Organisations should also be aware that products from vendors using Apache HTTP Server as third-party software may also be impacted by this vulnerability. Some of these affected products are listed here on the CVE-2021-40438 entry on Mitre's CVE List.
8 Oct 2021 A new path traversal vulnerability discovered in Apache HTTP Server 2.4.49 and 2.4.50.

Apache released Apache HTTP Server 2.4.50 on 04/20/2021 to address CVE-2021-41733 and CVE-2021-41524 but has since discovered that the fix for the path traversal CVE-2021-41733 vulnerability in this update was insufficient. A new path traversal vulnerability has been discovered, that affects Apache HTTP Server 2.4.49 and 2.4.50, tracked as CVE-2021-42013, and rated by Apache as 'critical'. This vulnerability could allow an attacker to use a path traversal attack to map URLs to files outside the directories configured by Alias-like directive. The attack could be successful if files are not protected by the default "Require all denied" option. If CGI scripts are also enabled on theses alias paths, this could result in remote code execution (RCE). Apache has now released a further security update, Apache HTTP Server 2.4.51, that fixes CVE-2021-42013 as well as fixing CVE-2021-41733 and CVE-2021-41524.

Remediation advice

Apache HTTP Server 2.4.49 and 2.4.50 are affected by these vulnerabilities, and the vulnerabilities are fixed in the Apache HTTP Server 2.4.51 update. Affected organisations are encouraged to review the Apache HTTP Server 2.4 security advisory page and apply the necessary update.

CVE Vulnerabilities

Status Published

CVE-2021-42013

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
Status Published

CVE-2021-41773

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.
Status Published

CVE-2021-41524

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.
Status Published

CVE-2021-40438

A crafted request uri-path can cause mod_proxy to forward the request to an origin server chosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Last edited: 13 January 2022 5:03 pm