{"id":101551,"date":"2021-10-06T04:22:36","date_gmt":"2021-10-06T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta"},"modified":"2021-10-06T04:22:36","modified_gmt":"2021-10-06T02:22:36","slug":"uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","title":{"rendered":"Vulnerability in Apache http server 2.4.49 allowing access to files outside the website root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
An emergency update has been released for Apache http server 2.4.50, which fixes an actively exploited 0-day vulnerability (CVE-2021-41773) that allows access to files from areas outside the web root directory. This vulnerability enables arbitrary system files and web script source codes, readable by the user under which the http server is running, to be uploaded. Developers were notified of the problem on September 17, but could only release the update today after cases of the vulnerability being used to attack websites were recorded online. <\/p>\n
The danger of the vulnerability is somewhat mitigated by the fact that the issue only appears in the recently released version 2.4.49 and does not affect all earlier releases. Stable branches of conservative server distributions have not yet used the 2.4.49 release (Debian, RHEL, Ubuntu, SUSE), but the problem has affected continuously updated distributions such as Fedora, Arch Linux, and Gentoo, as well as FreeBSD ports. <\/p>\n
Luka zosta\u0142a spowodowana b\u0142\u0119dem wprowadzonym podczas przer\u00f3bki kodu do normalizacji \u015bcie\u017cek w URI, przez co zakodowany za pomoc\u0105 sekwencji «» znak kropki w \u015bcie\u017cce nie zosta\u0142 znormalizowany, je\u015bli poprzedza\u0142a go inna kropka. W ten spos\u00f3b mo\u017cliwe sta\u0142o si\u0119 wstawienie nieoczyszczonych symboli «../» do wynikowej \u015bcie\u017cki poprzez wskazanie w zapytaniu sekwencji «./». Na przyk\u0142ad, zapytanie o postaci «https://example.com/cgi-bin/././././etc/passwd» lub «https://example.com/cgi-bin/.////etc/hosts» pozwala\u0142o uzyska\u0107 zawarto\u015b\u0107 pliku «/etc/passwd». <\/p>\n
The problem does not occur if access to directories is explicitly denied using the setting \u2018require all denied\u2019. For partial protection, you can specify in the configuration file: require all denied <\/p>\n
In Apache httpd version 2.4.50, another vulnerability (CVE-2021-41524) affecting the module implementing the HTTP\/2 protocol has also been fixed. This vulnerability allowed sending specially crafted requests to trigger a null pointer dereference and crash the process. This vulnerability also only manifests in version 2.4.49. As a workaround for protection, you can disable HTTP\/2 support. \n \u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"