{"id":101564,"date":"2021-10-08T10:22:44","date_gmt":"2021-10-08T08:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta"},"modified":"2021-10-08T10:22:44","modified_gmt":"2021-10-08T08:22:44","slug":"eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","title":{"rendered":"Une autre vuln\u00e9rabilit\u00e9 dans Apache httpd, permettant d'acc\u00e9der en dehors du r\u00e9pertoire racine du site","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un nouveau vecteur d'attaque a \u00e9t\u00e9 d\u00e9couvert pour le serveur http Apache, qui n'a pas \u00e9t\u00e9 corrig\u00e9 dans la mise \u00e0 jour 2.4.50 et permet d'acc\u00e9der \u00e0 des fichiers en dehors du r\u00e9pertoire racine du site. De plus, des chercheurs ont trouv\u00e9 un moyen permettant, sous certaines configurations non standards, non seulement de lire des fichiers syst\u00e8me, mais aussi d'ex\u00e9cuter du code \u00e0 distance sur le serveur. Le probl\u00e8me n'appara\u00eet que dans les versions 2.4.49 et 2.4.50, les versions ant\u00e9rieures ne sont pas vuln\u00e9rables. Pour rem\u00e9dier \u00e0 cette nouvelle variante de vuln\u00e9rabilit\u00e9, une mise \u00e0 jour rapide d'Apache httpd 2.4.51 a \u00e9t\u00e9 publi\u00e9e. <\/p>\n

En essence, le nouveau probl\u00e8me (CVE-2021-42013) est compl\u00e8tement analogue \u00e0 la vuln\u00e9rabilit\u00e9 initiale (CVE-2021-41773) dans la version 2.4.49, la seule diff\u00e9rence \u00e9tant un encodage diff\u00e9rent des caract\u00e8res \u00ab .. \u00bb. En particulier, dans la version 2.4.50, l'utilisation de la s\u00e9quence \u00ab \u00bb pour encoder un point a \u00e9t\u00e9 bloqu\u00e9e, mais la possibilit\u00e9 de double encodage a \u00e9t\u00e9 n\u00e9glig\u00e9e - en indiquant la s\u00e9quence \u00ab % \u00bb serveur<\/a> a \u00e9t\u00e9 d\u00e9cod\u00e9 en \u00ab \u00bb, puis en \u00ab . \u00bb, c'est-\u00e0-dire que les caract\u00e8res \u00ab .. \/ \u00bb pour revenir au r\u00e9pertoire pr\u00e9c\u00e9dent pouvaient \u00eatre encod\u00e9s comme \u00ab .% \/ \u00bb. <\/p>\n

En ce qui concerne l'exploitation de la vuln\u00e9rabilit\u00e9 par l'ex\u00e9cution de code, cela est possible lorsque mod_cgi est activ\u00e9 et que le chemin de base autorise l'ex\u00e9cution de scripts CGI (par exemple, si la directive ScriptAlias est activ\u00e9e ou que le drapeau ExecCGI est sp\u00e9cifi\u00e9 dans la directive Options). Une exigence essentielle pour la r\u00e9ussite de l'attaque est \u00e9galement la fourniture explicite dans les param\u00e8tres d'Apache d'un acc\u00e8s aux r\u00e9pertoires contenant des fichiers ex\u00e9cutables, tels que \/bin, ou un acc\u00e8s \u00e0 la racine du syst\u00e8me de fichiers \u00ab \/ \u00bb. \u00c9tant donn\u00e9 que cet acc\u00e8s n'est g\u00e9n\u00e9ralement pas fourni, l'attaque par ex\u00e9cution de code est peu applicable aux syst\u00e8mes r\u00e9els. <\/p>\n

Cela dit, l'attaque visant \u00e0 obtenir le contenu de fichiers syst\u00e8me arbitraires et des codes source de scripts Web accessibles en lecture par l'utilisateur sous lequel le serveur HTTP est ex\u00e9cut\u00e9 demeure d'actualit\u00e9. Pour mener \u00e0 bien une telle attaque, il suffit d'avoir sur le site un r\u00e9pertoire configur\u00e9 \u00e0 l'aide des directives \u00ab Alias \u00bb ou \u00ab ScriptAlias \u00bb (DocumentRoot ne suffit pas), comme \u00ab cgi-bin \u00bb. <\/p>\n

Exemple d'exploit permettant d'ex\u00e9cuter l'utilitaire \u00ab id \u00bb sur le serveur<\/a>: curl \u2018http:\/\/192.168.0.1\/cgi-bin\/.%\/.%\/.%\/.%\/.%\/bin\/sh\u2019 --data \u2018echo Content-Type: text\/plain; echo; id\u2019 uid=1(daemon) gid=1(daemon) groups=1(daemon) <\/p>\n

Exemple d'exploits permettant d'afficher le contenu de \/etc\/passwd et d'un des scripts web (pour renvoyer le code des scripts en tant que base, un r\u00e9pertoire sp\u00e9cifi\u00e9 par la directive \u00ab Alias \u00bb o\u00f9 l'ex\u00e9cution des scripts n'est pas autoris\u00e9e doit \u00eatre utilis\u00e9) : curl \u2018http:\/\/192.168.0.1\/cgi-bin\/.%\/.%\/.%\/.%\/.%\/etc\/passwd\u2019 curl \u2018http:\/\/192.168.0.1\/aliaseddir\/.%\/.%\/.%\/.%\/.%\/usr\/local\/apache2\/cgi-bin\/test.cgi\u2019 <\/p>\n

Le probl\u00e8me concerne principalement les distributions mises \u00e0 jour en continu, telles que Fedora, Arch Linux et Gentoo, ainsi que les ports de FreeBSD. Les paquets dans les versions stables des distributions serveurs conservatrices comme Debian, RHEL, Ubuntu et SUSE ne sont pas affect\u00e9s par cette vuln\u00e9rabilit\u00e9. Le probl\u00e8me ne se manifeste pas si l'acc\u00e8s aux r\u00e9pertoires est explicitement interdit par la configuration \u00ab require all denied \u00bb.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0430\u0439\u0434\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 http-\u0441\u0435\u0440\u0432\u0435\u0440 Apache, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 2.4.50 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0439\u0434\u0435\u043d \u0441\u043f\u043e\u0441\u043e\u0431, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u043d\u043e \u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 2.4.49 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101564","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Une autre vuln\u00e9rabilit\u00e9 dans Apache httpd, permettant d'acc\u00e9der en dehors du r\u00e9pertoire racine du site | ProHoster","description":"Un nouveau vecteur d'attaque a \u00e9t\u00e9 d\u00e9couvert sur le serveur http Apache, qui reste non corrig\u00e9 dans la mise \u00e0 jour 2.4.50 et permet d'acc\u00e9der aux fichiers en dehors du r\u00e9pertoire racine du site.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache httpd, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430 | ProHoster","og:description":"\u041d\u0430\u0439\u0434\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 http-\u0441\u0435\u0440\u0432\u0435\u0440 Apache, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 2.4.50 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-08T08:22:44+00:00","article:modified_time":"2021-10-08T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101564","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-08 08:27:47","updated":"2026-02-09 21:39:45","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/101564","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=101564"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/101564\/revisions"}],"predecessor-version":[{"id":172948,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/101564\/revisions\/172948"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=101564"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=101564"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=101564"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}