x
Limited Time Offer: Save up to 20% on a new CIS SecureSuite Membership | Learn more
×
Why CIS Solutions Join CIS Resources
CIS WorkBench Sign-in CIS WorkBench Sign In CIS Hardened Images CIS Hardened Images Support CIS Support


Why CIS

Who We Are

CIS is an independent, nonprofit organization with a mission to create confidence in the connected world



About Us Leadership Principles Testimonials

Solutions

secure your organization
Secure Your Organization


secure specific platforms
Secure Specific Platforms


cis securesuite CIS SecureSuite® Learn More      Apply Now  
u s state local tribal and territorial governments
U.S. State, Local, Tribal & Territorial Governments


View All Products & Services  

Join CIS

Get Involved

Join CIS as a member, partner, or volunteer - or explore our career opportunities



CIS SecureSuite® Membership Multi-State ISAC (MS-ISAC®) Elections Infrastructure ISAC (EI-ISAC®) CIS CyberMarket® Vendors CIS Communities Careers

Resources

resources
Resources


learn
Learn


filter by topic
Filter by Topic


View All Resources  
CIS Logo Show Search Expand Menu

A Vulnerability in Apache HTTP Server Could Allow for a Path Traversal Attack

MS-ISAC ADVISORY NUMBER:

2021-127

DATE(S) ISSUED:

10/05/2021

OVERVIEW:

A vulnerability has been discovered in Apache HTTP Server, which could allow for a path traversal attack. Apache HTTP Server is an open-source, cross-platform web server for Unix and Windows. Successful exploitation allows threat actors to map URLs to files outside the expected document root by launching a path traversal attack and would give a remote attacker access to arbitrary files outside of the document root on the vulnerable web server. Additionally, exploits of this flaw may lead to the leaking of the source of interpreted files such as CGI scripts.

THREAT INTELLIGENCE:

Apache has reported this vulnerability is actively being exploited in the wild.

SYSTEMS AFFECTED:

  • Apache HTTP Server 2.4.49
  • Apache HTTP Server 2.4.50

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: MEDIUM
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: MEDIUM
Home Users:
LOW

TECHNICAL SUMMARY:

A vulnerability has been discovered in Apache HTTP Server, which could allow for a path traversal attack. The vulnerability was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by the "require all denied" access control parameter, disabled be default, these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. Path traversal attacks involve sending requests to access backend or sensitive server directories that should be out of reach. With this vulnerability, the filters are bypassed by using encoded characters (ASCII) for the URLs. Successful exploitation allows threat actors to map URLs to files outside the expected document root by launching a path traversal attack and would give a remote attacker access to arbitrary files outside of the document root on the vulnerable web server. Additionally, exploits of this flaw may lead to the leaking of the source of interpreted files such as CGI scripts.

October 8 – UPDATED TECHNICAL SUMMARY:
A vulnerability has been discovered in Apache HTTP Server, which could allow for a path traversal attack. The vulnerability was found in a change made to path normalization in Apache HTTP Server versions 2.4.49 and 2.4.50. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by the "require all denied" access control parameter, disabled be default, these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. Path traversal attacks involve sending requests to access backend or sensitive server directories that should be out of reach. With this vulnerability, the filters are bypassed by using encoded characters (ASCII) for the URLs. Successful exploitation allows threat actors to map URLs to files outside the expected document root by launching a path traversal attack and would give a remote attacker access to arbitrary files outside of the document root on the vulnerable web server. Additionally, exploits of this flaw may lead to the leaking of the source of interpreted files such as CGI scripts.

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Apply the latest Apache HTTP Server patch (2.4.50) for your platform
  • Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
  • Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.
  • Apply the Principle of Least Privilege to all systems and services.

**October 8 – UPDATED RECOMMENDATIONS:
We recommend the following actions be taken:

  • Apply the latest Apache HTTP Server patch (2.4.51) for your platform
  • Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
  • Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.
  • Apply the Principle of Least Privilege to all systems and services.**

REFERENCES:

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Related Resources





Arrow Apache HTTP Server

Information Hub : Advisories


CONTROL: 1 --- ADVISORY CONTROL: 0
CONTROL: 2 --- ADVISORY CONTROL: 0
CONTROL: 3 --- ADVISORY CONTROL: 0

Pencil Blog post 20 Oct 2021
CONTROL: 4 --- ADVISORY CONTROL: 0