{"id":101551,"date":"2021-10-06T04:22:36","date_gmt":"2021-10-06T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta"},"modified":"2021-10-06T04:22:36","modified_gmt":"2021-10-06T02:22:36","slug":"uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","title":{"rendered":"Vulnerability in Apache HTTP Server 2.4.49 allowing access to files outside the site root.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
An emergency update has been released for the Apache HTTP server 2.4.50, which addresses an actively exploited 0-day vulnerability (CVE-2021-41773) that allows access to files outside the site's root directory. This vulnerability can be exploited to upload arbitrary system files and source code of web scripts that are readable by the user under which the HTTP server is running. Developers were notified about the issue on September 17 but could only release the update today after cases of vulnerability exploitation were observed online. <\/p>\n
The danger posed by the vulnerability is somewhat mitigated by the fact that the issue only affects the recently released version 2.4.49 and does not impact earlier releases. In stable branches of conservative server distributions, version 2.4.49 has not yet been used (Debian, RHEL, Ubuntu, SUSE), but the issue has affected continuously updated distributions such as Fedora, Arch Linux, and Gentoo, as well as FreeBSD ports. <\/p>\n
The vulnerability is caused by an error introduced during the code revision for normalizing paths in the URI, which prevents the character dot encoded with the sequence from being normalized if it is preceded by another dot. Consequently, it became feasible to inject uncleaned characters \"..\\\/\" into the resulting path by specifying the sequence \".\\\/\" in the request. For instance, a request like \"https:\/\/example.com\/cgi-bin\/.\/.\/.\/.\/etc\/passwd\" or \"https:\/\/example.com\/cgi-bin\/.\/\/\/\/etc\/hosts\" would allow access to the contents of the file \"\/etc\/passwd\". <\/p>\n
The problem does not occur if access to directories is explicitly denied using the configuration setting \"require all denied\". For partial protection, you can specify in the configuration file: require all denied <\/p>\n
Version Apache httpd 2.4.50 also addresses another vulnerability (CVE-2021-41524) affecting the module that implements the HTTP\/2 protocol. This vulnerability allowed the sending of a specially crafted request to initiate a null pointer dereference and crash the process. This vulnerability also only appears in version 2.4.49. As a workaround for protection, you can disable support for the HTTP\/2 protocol. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"