{"id":101564,"date":"2021-10-08T10:22:44","date_gmt":"2021-10-08T08:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta"},"modified":"2021-10-08T10:22:44","modified_gmt":"2021-10-08T08:22:44","slug":"eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","title":{"rendered":"Another vulnerability in Apache httpd, allowing access beyond the web root directory.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A new attack vector has been found on the Apache HTTP server, which remained unpatched in the 2.4.50 update and allows access to files from areas outside the website's root directory. Additionally, researchers have discovered a way, under certain non-standard settings, not only to read system files but also to remotely execute their code on the server. The issue only manifests in versions 2.4.49 and 2.4.50; earlier versions are not vulnerable. An Apache httpd 2.4.51 release has been promptly created to address this new vulnerability variant. <\/p>\n

At its core, the new vulnerability (CVE-2021-42013) is entirely analogous to the original vulnerability (CVE-2021-41773) in version 2.4.49, the only difference being a different character encoding for «..». Specifically, in release 2.4.50, the usage of the sequence «» to encode a dot was blocked, but the possibility of double encoding was overlooked \u2014 by specifying the sequence «%» server<\/a> decoded it into «», and then into «.», meaning that the characters «..» for moving to the previous directory could be encoded as «.%». <\/p>\n

As for the exploitation of the vulnerability through code execution, this is possible when mod_cgi is enabled and the base path allows the execution of CGI scripts (for example, if the ScriptAlias directive is enabled or the ExecCGI flag is specified in the Options directive). A mandatory requirement for a successful attack is also explicitly granting access in the Apache settings to directories with executable files, such as \/bin, or access to the root FS « \/ ». Since such access is usually not granted, the code execution attack is rarely applicable to real systems. <\/p>\n

Meanwhile, the attack aimed at accessing the content of arbitrary system files and source texts of web scripts accessible to the user under which the HTTP server is running remains relevant. To carry out such an attack, it is sufficient to have a directory on the site set up using the «Alias» or «ScriptAlias» directives (DocumentRoot is not enough), such as «cgi-bin». <\/p>\n

Example of an exploit that allows executing the «id» utility on server<\/a>: curl ‘http:\/\/192.168.0.1\/cgi-bin\/.%\/.%\/.%\/.%\/.%\/bin\/sh’ —data ‘echo Content-Type: text\/plain; echo; id’ uid=1(daemon) gid=1(daemon) groups=1(daemon) <\/p>\n

Example of exploits that allow displaying the content of \/etc\/passwd and one of the web scripts (to deliver the script code, a specific directory set up via the «Alias» directive must be specified, for which script execution is not enabled): curl ‘http:\/\/192.168.0.1\/cgi-bin\/.%\/.%\/.%\/.%\/.%\/etc\/passwd’ curl ‘http:\/\/192.168.0.1\/aliaseddir\/.%\/.%\/.%\/.%\/.%\/usr\/local\/apache2\/cgi-bin\/test.cgi’ <\/p>\n

The issue mainly affects continuously updated distributions such as Fedora, Arch Linux, and Gentoo, as well as FreeBSD ports. Packages in stable branches of conservative server distributions like Debian, RHEL, Ubuntu, and SUSE are not vulnerable to this exploit. The problem does not manifest if access to directories is explicitly prohibited using the 'require all denied' setting.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0430\u0439\u0434\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 http-\u0441\u0435\u0440\u0432\u0435\u0440 Apache, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 2.4.50 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0439\u0434\u0435\u043d \u0441\u043f\u043e\u0441\u043e\u0431, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u043d\u043e \u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 2.4.49 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101564","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Another vulnerability in Apache httpd allows access beyond the website's root directory | ProHoster","description":"A new attack vector has been discovered for the Apache http server, which remained unpatched in the 2.4.50 update and allows access to files from areas outside the website's root directory.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache httpd, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430 | ProHoster","og:description":"\u041d\u0430\u0439\u0434\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 http-\u0441\u0435\u0440\u0432\u0435\u0440 Apache, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 2.4.50 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-08T08:22:44+00:00","article:modified_time":"2021-10-08T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101564","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-08 08:27:47","updated":"2026-02-09 21:39:45","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/101564","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=101564"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/101564\/revisions"}],"predecessor-version":[{"id":172948,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/101564\/revisions\/172948"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=101564"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=101564"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=101564"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}