CERT-In Advisory
CIAD-2021-0039
Multiple Vulnerabilities in Apache HTTP Server
Original Issue Date: October 06, 2021
Severity Rating: High
Systems Affected
- Apache HTTP Server version 2.4.49
Overview
Multiple vulnerabilities have been reported in Apache HTTP Server which could be exploited by a remote attacker to execute arbitrary code or cause denial of service conditions on the target system.
Description
1. Directory traversal Vulnerability
(
CVE-2021-41773
)
The vulnerability exists in Apache HTTP Server due to incomplete path normalization logic implemented. A remote attacker could exploit this vulnerability by sending specially crafted requests to map URLs to files outside the expected document root.
Successful exploitation of this vulnerability could allow a remote attacker to traverse directories on the system, if files outside of the document root are not protected by "require all denied" these requests can succeed. This vulnerability could also expose the source of interpreted files like CGI scripts, which may be used for further attacks.
Note: This issue is currently exploited in the wild, users are advised to upgrade urgently.
2. Denial of Service Vulnerability
(
CVE-2021-41524
)
This vulnerability exists in Apache HTTP Server due to NULL pointer dereference error in HTTP/2 requests. A remote attacker could exploit this vulnerability by sending a specially crafted request to perform a denial of service(DoS) condition on the targeted system.
Solution
Upgrade to Apache HTTP Server 2.4.50:
https://httpd.apache.org/security/vulnerabilities_24.html
Vendor Information
Apache HTTP Server
https://httpd.apache.org/security/vulnerabilities_24.html
References
Apache HTTP Server
https://httpd.apache.org/security/vulnerabilities_24.html
CVE Name
CVE-2021-41773
CVE-2021-41524
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|