{"id":101551,"date":"2021-10-06T04:22:36","date_gmt":"2021-10-06T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta"},"modified":"2021-10-06T04:22:36","modified_gmt":"2021-10-06T02:22:36","slug":"uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","title":{"rendered":"Zranitelnost v http serveru Apache 2.4.49, kter\u00e1 umo\u017e\u0148uje p\u0159\u00edstup k soubor\u016fm mimo ko\u0159en webu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byla rychle vyd\u00e1na aktualizace http serveru Apache 2.4.50, kter\u00e1 odstra\u0148uje ji\u017e aktivn\u011b zneu\u017e\u00edvanou 0-day zranitelnost (CVE-2021-41773), je\u017e umo\u017e\u0148uje p\u0159\u00edstup k soubor\u016fm z oblast\u00ed mimo ko\u0159enov\u00fd adres\u00e1\u0159 webu. Pomoc\u00ed t\u00e9to zranitelnosti lze nahr\u00e1t libovoln\u00e9 syst\u00e9mov\u00e9 soubory a zdrojov\u00e9 k\u00f3dy webov\u00fdch skript\u016f, kter\u00e9 jsou \u010diteln\u00e9 pro u\u017eivatele, pod kter\u00fdm je spu\u0161t\u011bn http server. V\u00fdvoj\u00e1\u0159i byli na probl\u00e9m upozorn\u011bni ji\u017e 17. z\u00e1\u0159\u00ed, ale aktualizaci se poda\u0159ilo vydat a\u017e dnes, pot\u00e9 co byly na internetu zaznamen\u00e1ny p\u0159\u00edpady zneu\u017eit\u00ed t\u00e9to zranitelnosti pro \u00fatoky na weby. <\/p>\n

Nebezpe\u010dnost zranitelnosti zm\u00edr\u0148uje to, \u017ee probl\u00e9m se projevuje pouze v ned\u00e1vno vydan\u00e9 verzi 2.4.49 a net\u00fdk\u00e1 se v\u0161ech p\u0159edchoz\u00edch vyd\u00e1n\u00ed. Stabiln\u00ed v\u011btve konzervativn\u00edch serverov\u00fdch distribuc\u00ed verzi 2.4.49 je\u0161t\u011b nevyu\u017e\u00edvaly (Debian, RHEL, Ubuntu, SUSE), ale probl\u00e9m zas\u00e1hl kontinu\u00e1ln\u011b aktualizovan\u00e9 distribuce, jako jsou Fedora, Arch Linux a Gentoo, stejn\u011b jako porty FreeBSD. <\/p>\n

Zranitelnost je zp\u016fsobena chybou, kter\u00e1 byla zaveden\u00e1 p\u0159i p\u0159epracov\u00e1n\u00ed k\u00f3du pro normalizaci cest v URI, kv\u016fli kter\u00e9 se k\u00f3dovan\u00fd znak «» v cest\u011b nnormalizoval, pokud mu p\u0159edch\u00e1zela jin\u00e1 te\u010dka. T\u00edmto zp\u016fsobem bylo mo\u017en\u00e9 vlo\u017eit nevy\u010di\u0161t\u011bn\u00e9 znaky «../» do v\u00fdsledn\u00e9 cesty prost\u0159ednictv\u00edm zad\u00e1n\u00ed sekvence «./» v dotazu. Nap\u0159\u00edklad dotaz ve tvaru «https://example.com/cgi-bin/././././etc/passwd» nebo «https://example.com/cgi-bin/.////etc/hosts» umo\u017e\u0148oval z\u00edskat obsah souboru «/etc/passwd». <\/p>\n

Probl\u00e9m se neprojevuje, pokud je p\u0159\u00edstup k adres\u00e1\u0159\u016fm v\u00fdslovn\u011b zak\u00e1z\u00e1n pomoc\u00ed nastaven\u00ed \"require all denied\". Nap\u0159\u00edklad pro \u010d\u00e1ste\u010dnou ochranu lze uv\u00e9st v konfigura\u010dn\u00edm souboru: require all denied <\/p>\n

Ve verzi Apache httpd 2.4.50 byla tak\u00e9 odstran\u011bna dal\u0161\u00ed zranitelnost (CVE-2021-41524), kter\u00e1 se t\u00fdkala modulu implementuj\u00edc\u00edho protokol HTTP\\\/2. Zranitelnost umo\u017enila zasl\u00e1n\u00edm speci\u00e1ln\u011b form\u00e1tovan\u00e9ho po\u017eadavku iniciovat dereferencov\u00e1n\u00ed nulov\u00e9ho ukazatele a zp\u016fsobit p\u00e1d procesu. Tato zranitelnost se tak\u00e9 projevuje pouze ve verzi 2.4.49. Jako obranou metodou lze vypnout podporu protokolu HTTP\\\/2.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.50, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-41773), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b web-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u0430\u043f\u0443\u0449\u0435\u043d http-\u0441\u0435\u0440\u0432\u0435\u0440. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0431\u044b\u043b\u0438 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0435\u0449\u0451 17 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101551","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v http-serveru Apache 2.4.49, kter\u00e1 umo\u017e\u0148uje p\u0159\u00edstup k soubor\u016fm mimo ko\u0159en webu | ProHoster","description":"Bylo urgentn\u011b vyd\u00e1no aktualizace http-serveru Apache 2.4.50, kter\u00e9 odstra\u0148uje ji\u017e aktivn\u011b zneu\u017e\u00edvanou 0-day zranitelnost (CVE-2021-41773), je\u017e umo\u017e\u0148uje p\u0159\u00edstup k soubor\u016fm mimo stanoven\u00e9 oblasti.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Apache 2.4.49, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u044f \u0441\u0430\u0439\u0442\u0430 | ProHoster","og:description":"\u0412 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.50, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-41773), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-06T02:22:36+00:00","article:modified_time":"2021-10-06T02:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101551","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-06 02:24:19","updated":"2022-09-29 22:14:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=101551"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101551\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=101551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=101551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=101551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}