Apache HTTP Server Could Allow for a Path Traversal Attack

Fortify Security Team
Oct 5, 2021

A vulnerability has been discovered in Apache HTTP Server, which could allow for a path traversal attack. Apache HTTP Server is an open-source, cross-platform web server for Unix and Windows. Successful exploitation allows threat actors to map URLs to files outside the expected document root by launching a path traversal attack and would give a remote attacker access to arbitrary files outside of the document root on the vulnerable web server. Additionally, exploits of this flaw may lead to the leaking of the source of interpreted files such as CGI scripts.

THREAT INTELLIGENCE: Apache has reported this vulnerability is actively being exploited in the wild.

SYSTEMS AFFECTED:

  • Apache HTTP Server 2.4.49

RISK:
Government:

  • Large and medium government entities: High
  • Small government entities: Medium

Businesses:

  • Large and medium business entities: High
  • Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:

A vulnerability has been discovered in Apache HTTP Server, which could allow for a path traversal attack. The vulnerability was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by the “require all denied” access control parameter, disabled be default, these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. Path traversal attacks involve sending requests to access backend or sensitive server directories that should be out of reach. With this vulnerability, the filters are bypassed by using encoded characters (ASCII) for the URLs. Successful exploitation allows threat actors to map URLs to files outside the expected document root by launching a path traversal attack and would give a remote attacker access to arbitrary files outside of the document root on the vulnerable web server. Additionally, exploits of this flaw may lead to the leaking of the source of interpreted files such as CGI scripts.

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Apply the latest Apache HTTP Server patch (2.4.50) for your platform
  • Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
  • Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.
  • Apply the Principle of Least Privilege to all systems and services.

REFERENCES:
CVE:
https://www.cve.org/CVERecord?id=CVE-2021-41773

Bleeping Computer:
https://www.bleepingcomputer.com/news/security/apache-fixes-actively-exploited-zero-day-vulnerability-patch-now/

Recent Posts

Google Chrome Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe of these vulnerabilities could...

Oracle Quarterly Critical Patches Issued April 19, 2022

Multiple vulnerabilities have been discovered in Oracle products, which could allow for remote code execution. April 22 – THREAT INTELLIGENCE UPDATED: A new proof of concept code demonstrating a newly disclosed digital signature bypass vulnerability in Java has been...

WSO2 Products Could Allow for Remote Code Execution

A vulnerability has been discovered in specific WSO2 products, which could allow for remote code execution. WSO2 is an open-source technology provider. It offers an enterprise platform for integrating application programming interfaces (API), applications, and web...