{"id":101551,"date":"2021-10-06T04:22:36","date_gmt":"2021-10-06T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta"},"modified":"2021-10-06T04:22:36","modified_gmt":"2021-10-06T02:22:36","slug":"uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","title":{"rendered":"Vulnerabilitate \u00een serverul HTTP Apache 2.4.49, care permite accesul la fi\u0219iere dincolo de r\u0103d\u0103cina site-ului","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A fost efectuat\u0103 o actualizare de urgen\u021b\u0103 pentru serverul http Apache 2.4.50, care a eliminat o vulnerabilitate 0-day activ exploatat\u0103 (CVE-2021-41773), permi\u021b\u00e2nd accesul la fi\u0219iere din zone externe r\u0103d\u0103cinii site-ului. Prin intermediul acestei vulnerabilit\u0103\u021bi, se pot \u00eenc\u0103rca fi\u0219iere sistemice aleatorii \u0219i coduri surs\u0103 web disponibile pentru citire utilizatorului sub care ruleaz\u0103 serverul http. Dezvoltatorii au fost informa\u021bi despre problem\u0103 \u00eenc\u0103 din 17 septembrie, dar au reu\u0219it s\u0103 emit\u0103 actualizarea doar ast\u0103zi, dup\u0103 ce au fost \u00eenregistrate cazuri de utilizare a vulnerabilit\u0103\u021bii pentru a ataca site-uri. <\/p>\n

Pericolul vulnerabilit\u0103\u021bii este atenuat de faptul c\u0103 problema se manifest\u0103 doar \u00een versiunea recent lansat\u0103 2.4.49 \u0219i nu afecteaz\u0103 versiunile anterioare. \u00cen ramurile stabile ale distribu\u021biilor serverelor conservatoare, versiunea 2.4.49 nu a fost \u00eenc\u0103 utilizat\u0103 (Debian, RHEL, Ubuntu, SUSE), dar problema a afectat distribu\u021biile care sunt actualizate continuu, precum Fedora, Arch Linux \u0219i Gentoo, precum \u0219i porturile FreeBSD. <\/p>\n

Vulnerabilitatea este cauzat\u0103 de o eroare introdus\u0103 \u00een timpul reform\u0103rii codului pentru normalizarea c\u0103ilor \u00een URI, din cauza c\u0103reia caracterul punct codificat prin secven\u021ba \"\" din cale nu a fost normalizat, dac\u0103 era precedat de un alt punct. Astfel, s-a posibilizat introducerea de caractere necur\u0103\u021bate \"..\\\/\" \u00een calea rezultat\u0103 prin specificarea \u00een cerere a secven\u021bei \".\\\/\". De exemplu, o cerere de tipul \"https:\\\/\\\/example.com\\\/cgi-bin\\\/.\\\/.\\\/.\\\/.\\\/etc\\\/passwd\" sau \"https:\\\/\\\/example.com\\\/cgi-bin\\\/.\\\/\\\/\\\/\\\/etc\\\/hosts\" permitea accesul la con\u021binutul fi\u0219ierului \"\\\/etc\\\/passwd\". <\/p>\n

Problema nu apare dac\u0103 accesul la directoare este interzis explicit prin setarea «require all denied». De exemplu, pentru o protec\u021bie par\u021bial\u0103, se poate specifica \u00een fi\u0219ierul de configurare: <Directory /> require all denied </Directory> <\/p>\n

\u00cen versiunea Apache httpd 2.4.50 a fost eliminat\u0103 \u0219i o alt\u0103 vulnerabilitate (CVE-2021-41524), care afecteaz\u0103 modulul care implementeaz\u0103 protocolul HTTP\\\/2. Vulnerabilitatea permitea, prin trimiterea unei cereri special concepute, ini\u021bierea derefer\u0103rii unui pointer nul, provoc\u00e2nd c\u0103derea procesului. Aceast\u0103 vulnerabilitate se manifest\u0103 de asemenea doar \u00een versiunea 2.4.49. Ca solu\u021bie temporar\u0103, se poate dezactiva suportul pentru protocolul HTTP\\\/2.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.50, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-41773), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b web-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u0430\u043f\u0443\u0449\u0435\u043d http-\u0441\u0435\u0440\u0432\u0435\u0440. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0431\u044b\u043b\u0438 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0435\u0449\u0451 17 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101551","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een serverul HTTP Apache 2.4.49, care permite accesul la fi\u0219iere \u00een afara r\u0103d\u0103cinii site-ului | ProHoster","description":"A fost lansat\u0103 de urgen\u021b\u0103 o actualizare pentru serverul HTTP Apache 2.4.50, \u00een care a fost eliminat\u0103 o vulnerabilitate 0-day activ exploatat\u0103 (CVE-2021-41773), care permite accesul la fi\u0219iere din zone externe.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Apache 2.4.49, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u044f \u0441\u0430\u0439\u0442\u0430 | ProHoster","og:description":"\u0412 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.50, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-41773), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-06T02:22:36+00:00","article:modified_time":"2021-10-06T02:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101551","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-06 02:24:19","updated":"2022-09-29 22:14:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=101551"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101551\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=101551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=101551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=101551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}