{"id":101564,"date":"2021-10-08T10:22:44","date_gmt":"2021-10-08T08:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta"},"modified":"2021-10-08T10:22:44","modified_gmt":"2021-10-08T08:22:44","slug":"eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","title":{"rendered":"Veel \u00fcks haavatavus Apache httpd-s, mis v\u00f5imaldab p\u00e4\u00e4seda ligip\u00e4\u00e4sule veebisaidi juurkataloogist v\u00e4ljaspool.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Leiti uus r\u00fcnnakusuund Apache http-serveril, mis j\u00e4i parandamata versioonis 2.4.50 ja v\u00f5imaldab p\u00e4\u00e4seda juurde failidele, mis asuvad saidi juurkatalooge v\u00e4ljaspool. Lisaks on teadlased leidnud v\u00f5imaluse, mis, kui teatavaid ebatavalisi seadistusi on olemas, v\u00f5imaldab mitte ainult lugeda s\u00fcsteemifaile, vaid ka kaugelt oma koodi serveris k\u00e4ivitada. Probleem ilmneb ainult versioonides 2.4.49 ja 2.4.50, varasemad versioonid ei ole haavatavad. Uue haavatavuse k\u00f5rvaldamiseks on kiiresti v\u00e4lja antud Apache httpd 2.4.51 versioon. <\/p>\n

Uus probleem (CVE-2021-42013) on oma olemuselt t\u00e4iesti sarnane algsele haavatavusele (CVE-2021-41773) versioonis 2.4.49, erinevus seisneb vaid s\u00fcmbolite «..» erinevas kodeeringus. T\u00e4psemalt, v\u00e4ljaandes 2.4.50 olid blokeeritud v\u00f5imalused kasutada j\u00e4rjestust «» punkti kodeerimiseks, aga j\u00e4eti t\u00e4helepanuta topeltkodeerimise v\u00f5imalus - kasutades j\u00e4rjestust «%». server<\/a> dekodeerisin selle «» ja seej\u00e4rel «.», st s\u00fcmboleid «..\\\/» eelnevasse kataloogi liikuda oli v\u00f5imalik kodeerida kui «.%\\\/». <\/p>\n

Mis puutub haavatavuse \u00e4rakasutamisse koodide k\u00e4itamise l\u00e4bi, siis see on v\u00f5imalik, kui mod_cgi on sisse l\u00fclitatud ja kasutatakse p\u00f5hiteed, kus on lubatud CGI-koodide t\u00e4itmine (n\u00e4iteks, kui on sisse l\u00fclitatud direktiiv ScriptAlias v\u00f5i on direktiivi Options all antud lipp ExecCGI). Eduka r\u00fcnnaku oluline n\u00f5ue on ka, et Apache seadetesse oleks selgelt antud juurdep\u00e4\u00e4s t\u00e4idetavatesse kataloogidesse, nagu \\\/bin, v\u00f5i juur FS-d «\\\/». Kuna tavaliselt ei anta sellist juurdep\u00e4\u00e4su, on koodi t\u00e4itmine rakendatav reaalsetes s\u00fcsteemides harva. <\/p>\n

Sellegipoolest j\u00e4\u00e4b aktuaalseks r\u00fcnnak, mille kaudu on v\u00f5imalik saada juurdep\u00e4\u00e4s mis tahes s\u00fcsteemifailide sisu ja veebiskripti l\u00e4htekoodidele, mis on kasutaja jaoks, mille all HTTP-server on k\u00e4ivitatud, loetavad. Sellise r\u00fcnnaku teostamiseks piisab, kui veebisaidil on katalog, mis on seadistatud direktiivide «Alias» v\u00f5i «ScriptAlias» abil (DocumentRoot ei ole piisav), nagu n\u00e4iteks «cgi-bin». <\/p>\n

N\u00e4ide eksploidist, mis v\u00f5imaldab k\u00e4ivitada utiliidi «id» aadressil serveris<\/a>: curl ‘http:\\\/\\\/192.168.0.1\\\/cgi-bin\\\/.%\\\/.%\\\/.%\\\/.%\\\/.%\\\/bin\\\/sh’ —data ‘echo Content-Type: text\\\/plain; echo; id’ uid=1(daemon) gid=1(daemon) groups=1(daemon) <\/p>\n

N\u00e4ide eksploididest, mis v\u00f5imaldavad kuvada sisu \\\/etc\\\/passwd ja \u00fche veebiskripti (kui skripti koodi andmiseks peab olema m\u00e4\u00e4ratud l\u00e4bi direktiivi «Alias» katalog, kus skriptide t\u00e4itmine ei ole lubatud): curl ‘http:\\\/\\\/192.168.0.1\\\/cgi-bin\\\/.%\\\/.%\\\/.%\\\/.%\\\/.%\\etc\\\/passwd’ curl ‘http:\\\/\\\/192.168.0.1\\\/aliaseddir\\\/.%\\\/.%\\\/.%\\\/.%\\\/.%\\\/usr\\\/local\\\/apache2\\\/cgi-bin\\\/test.cgi’ <\/p>\n

Probleem m\u00f5jutab peamiselt pidevalt uuendatavaid distributsi nagu Fedora, Arch Linux ja Gentoo, samuti FreeBSD sadamaid. Pakette stabiilsetes harudes konservatiivsetes serveri distributsioonides nagu Debian, RHEL, Ubuntu ja SUSE haavatavused ei m\u00f5juta. Probleem ei esine, kui juurdep\u00e4\u00e4s kataloogidele on selgelt keelatud seadistuse abil 'require all denied'.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0430\u0439\u0434\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 http-\u0441\u0435\u0440\u0432\u0435\u0440 Apache, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 2.4.50 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0439\u0434\u0435\u043d \u0441\u043f\u043e\u0441\u043e\u0431, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u043d\u043e \u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 2.4.49 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101564","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Veel \u00fcks haavatavus Apache httpd-s, mis v\u00f5imaldab p\u00e4\u00e4seda veebisaidi juurkataloogist v\u00e4ljapoole | ProHoster","description":"Leitud uus r\u00fcnnakuvektor Apache http-serverile, mis j\u00e4i 2.4.50 uuenduses lahendamata ja v\u00f5imaldab p\u00e4\u00e4seda failidele, mis asuvad veebisaidi juurkataloogist v\u00e4ljaspool.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache httpd, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430 | ProHoster","og:description":"\u041d\u0430\u0439\u0434\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 http-\u0441\u0435\u0440\u0432\u0435\u0440 Apache, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 2.4.50 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-08T08:22:44+00:00","article:modified_time":"2021-10-08T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101564","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-08 08:27:47","updated":"2026-02-09 21:39:45","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101564","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101564"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101564\/revisions"}],"predecessor-version":[{"id":172948,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101564\/revisions\/172948"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101564"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101564"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101564"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}