A new attack vector has been found on the Apache HTTP server, which remained unpatched in the 2.4.50 update and allows access to files from areas outside the website's root directory. Additionally, researchers have discovered a way, under certain non-standard settings, not only to read system files but also to remotely execute their code on the server. The issue only manifests in versions 2.4.49 and 2.4.50; earlier versions are not vulnerable. An Apache httpd 2.4.51 release has been promptly created to address this new vulnerability variant.
Essentially, the new problem (CVE-2021-42013) is completely analogous to the original vulnerability (CVE-2021-41773) in 2.4.49, with the only difference being the different encoding of the characters "..". Specifically, in version 2.4.50, the ability to use the sequence "" for encoding a dot was blocked, but the possibility of double encoding was missed — when specifying the sequence "%" server it decoded it to "", and then to ".", meaning that the characters "..\/" for moving to the previous directory could be encoded as ".%\/".
Regarding exploiting the vulnerability through code execution, this is possible when mod_cgi is enabled and a base path is used where executing CGI scripts is allowed (for example, if the ScriptAlias directive is enabled or the ExecCGI flag is set in the Options directive). A prerequisite for successfully conducting the attack is also explicit granting in the Apache settings of access to directories with executable files, such as \/bin, or access to the FS root "/". Since such access is typically not granted, the code execution attack is of limited applicability to real systems.
At the same time, the attack to obtain the contents of arbitrary system files and the source texts of web scripts, readable by the user under which the HTTP server is running, remains relevant. To carry out such an attack, it is sufficient to have a directory on the site configured using the "Alias" or "ScriptAlias" directives (DocumentRoot alone is not sufficient), such as "cgi-bin".
An example exploit that allows the execution of the "id" utility on server: curl 'http:\/\/192.168.0.1\/cgi-bin\/..%\/..%\/..%\/..%\/..%\/bin\/sh' --data 'echo Content-Type: text\/plain; echo; id' uid=1(daemon) gid=1(daemon) groups=1(daemon)
Example of exploits that allow retrieving the contents of /etc/passwd and one of the web scripts (to serve the script code as baseline, a specific directory must be specified through the 'Alias' directive, for which script execution is not enabled): curl 'http://192.168.0.1/cgi-bin/.%/.%/.%/.%/.%/etc/passwd' curl 'http://192.168.0.1/aliaseddir/.%/.%/.%/.%/.%/usr/local/apache2/cgi-bin/test.cgi'
The issue mainly affects continuously updated distributions such as Fedora, Arch Linux, and Gentoo, as well as FreeBSD ports. Packages in stable branches of conservative server distributions like Debian, RHEL, Ubuntu, and SUSE are not vulnerable. The problem does not manifest if access to directories is explicitly denied using the 'require all denied' configuration.
Source: opennet.ru
