Mar 14 2023

TWO VERY CRITICAL VULNERABILITIES PATCHED IN NEW APACHE HTTP SERVER UPDATE

Category: Security vulnerabilities,Web Security — DISC @ 8:22 am
Two very critical vulnerabilities patched in new Apache HTTP Server update

Apache HTTP Server is one of the web servers that is used the most often throughout the globe. It is responsible for providing power to millions of websites and apps. Recent vulnerabilities found in the server, on the other hand, have the ability to disclose sensitive information and make it easier for attackers to carry out further attacks. The Apache HTTP Server has recently been found to contain two significant vulnerabilities, both of which are detailed below. It is imperative that you rapidly upgrade Apache HTTP Server to the most recent version in order to protect your system against the vulnerabilities described.

Apache HTTP Server request splitting vulnerability,Ā CVE-2023-25690. This vulnerability is brought about by an issue that occurs in mod proxy whenever it is activated with a RewriteRule or ProxyPassMatch of some kind. This vulnerability might be used by a remote attacker to overcome access constraints in the proxy server, route undesired URLs to existing origin servers, and poison cache. Attacks using HTTP Request Smuggling are possible on Apache HTTP Server versions 2.4.0 through 2.4.55, if the server is configured with certain mod proxy settings. It occurs when mod proxy is enabled along with some form of RewriteRule or ProxyPassMatch. In these configurations, a non-specific pattern matches some portion of the user-supplied request-target (URL) data, and the matched data is then re-inserted into the proxied request-target utilizing variable substitution. This causes CVE-2023-25690 to be triggered. This might result in requests being split or smuggled, access rules being bypassed, and unwanted URLs being proxied to existing origin servers, all of which could lead to cache poisoning.

Zerobot botnet can now hack into Apache, Apache Spark servers

Versions of the Apache HTTP Server ranging from 2.4.30 to 2.4.55 are impacted by the problem. This attack is carried out by introducing unusual characters into the header of the origin response, which has the potential to either truncate or divide the response that is sent to the client. An attacker might take use of this vulnerability to inject their own headers into the request, causing the server to produce a split response.

Secure By Design

Tags: Apache HTTP Server

Dec 21 2021

Apacheā€™s other product: Critical bugs in ā€˜httpdā€™ web server, patch now!

Category: Web Security — DISC @ 11:37 am
Apache’s other product: Critical bugs in ‘httpd’ web server, patch now!

Pick a random person, and ask them these two questions:

Q1. Have you heard of Apache?
Q2. If so, can you name an Apache product?

Weā€™re willing to wager that you will get one of two replies:

A1. No. A2. (Not applicable.)
A1. Yes. A2. Log4j.

Two weeks ago, however, weā€™d suggest that very few people had heard of Log4j, and even amongst those cognoscenti, few would have been particularly interested in it.

Until a cluster of potentially catastrophic bugs ā€“ originally implemented as features, on the grounds that less is never more ā€“ were revealed under the bug-brand Log4Shell, the Log4j programming library was merely one of those many components that got sucked into and used by thousands, perhaps even hundreds of thousands, of Java applications and utilities.

Log4j was just ā€œpart of the supply chainā€ that came bundled into more back-end servers and cloud-based services than anyone actually realised until now.

Many sysdamins, IT staff and cybersecurity teams have spent the past two weeksĀ eradicating this programmatic plagueĀ from their demesnes. (Yes, thatā€™s a real word. Itā€™s pronouncedĀ domains, but the archaic spelling avoids implying a Windows network.)

Donā€™t forget ā€œthe other Apacheā€

Tags: Apache HTTP Server, Apache patch, critical bug

Nov 29 2021

Experts warn of attacks exploiting CVE-2021-40438 flaw in Apache HTTP Server

Category: Security vulnerabilities,Web Security — DISC @ 10:12 am
Experts warn of attacks exploiting CVE-2021-40438 flaw in Apache HTTP Server

Threat actors are exploiting a recently addressed server-side request forgery (SSRF) vulnerability, tracked as CVE-2021-40438, in Apache HTTP servers.

The CVE-2021-40438 flaw can be exploited against httpd web servers that have the mod_proxy module enabled. A threat actor can trigger the issue using a specially crafted request to cause the module to forward the request to an arbitrary origin server.

The vulnerability was patched in mid-September with the release of version 2.4.49, it impacts version 2.4.48 and earlier.

ā€œA crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.ā€ reads theĀ change logĀ for version 2.4.49.

Since the public disclosure of the vulnerability, several PoC exploits for CVE-2021-40438 have been published.

Now experts from Germanyā€™s Federal Office for Information Security (BSI) and Cisco are warning of ongoing attacks attempting to exploit the vulnerability.

Cisco published a security advisory to inform its customers that it is investigating the impact of the issue on its products. The issue impacts Prime Collaboration Provisioning, Security Manager, Expressway series and TelePresence Video Communication Server (VCS) products. However, the IT giant states that it is still investigating its product line.

ā€œIn November 2021, the Cisco PSIRT became aware of exploitation attempts of the vulnerability identified by CVE ID CVE-2021-40438.ā€ reads theĀ security advisoryĀ published by CISCO.

The German BSI agency also published an alert about this vulnerability, it is aware of at least one attack exploiting this vulnerability.

ā€œThe BSI is aware of at least one case in which an attacker was able to do so through exploitation the vulnerability to obtain hash values of user credentials from the victimā€™s system. The vulnerability affects all versions of Apache HTTP Server 2.4.48 or older.ā€ reads theĀ alertĀ published by the BSI.

INSTRUCTIONS FOR SET UP SECURITY POLICY WEB SERVER APACHE by [David Du]

Tags: Apache HTTP Server, CVE-2021-40438