Apache patch a zero-day flaw exploited in the wild

Apache has addressed two vulnerabilities, one of which is a path traversal and file disclosure flaw in its HTTP server actively exploited in the wild.

Apache has rolled out security patches to address two flaws, including a path traversal and file disclosure issue in its HTTP server that is actively exploited in the wild.

The two vulnerabilities have been tracked as CVE-2021-41773 and CVE-2021-41524.

The first issue, tracked as CVE-2021-41773, is a path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49. An attacker can trigger the flaw to map URLs to files outside the expected document root.

“A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root.” reads the advisory. “If files outside of the document root are not protected by “require all denied” these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts.”

The vulnerability affects only Apache 2.4.49, earlier versions are not impacted. The vulnerability was reported by Ash Daulton along with the cPanel Security Team. According to the advisory, the issue is known to be exploited in the wild.

Apache also addressed a null pointer dereference in HTTP/2 fuzzing tracked as CVE-2021-41524.

“While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request.” reads the advisory.

An attack can trigger the flaw to perform a denial-of-service (DoS) attack on the server.

The flaw was recently introduced in version 2.4.49.

Users are recommended to install the patches immediately, a growing number of threat actors could start exploiting the flaw in the coming weeks.

Security experts at Positive Technologies announced to have already reproduced the CVE-2021-41773 flaw.

We have reproduced the fresh CVE-2021-41773 Path Traversal vulnerability in Apache 2.4.49.

If files outside of the document root are not protected by “require all denied” these requests can succeed.

Patch ASAP! https://t.co/6JrbayDbqG pic.twitter.com/AnsaJszPTE

— PT SWARM (@ptswarm) October 5, 2021

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Apache)

The post Apache patch a zero-day flaw exploited in the wild appeared first on Security Affairs.

Recent Posts
Contact Us

We're not around right now. But you can send us an email and we'll get back to you, asap.

Not readable? Change text. captcha txt