Apache web server users urged to patch immediately

Users of the open source Apache HTTP Server who have updated to recently released version 2.4.49 are being urged to update to 2.4.50 immediately to apply fixes for a newly disclosed zero-day that is already being actively exploited by malicious actors.

First reported a week ago on 29 September, the expedited fix reflects the widespread usage of the Apache Software Foundation’s free, cross-platform web server software, which dates back to the mid-1990s and was a driving force in the rapid development of the world wide web at the time. It still serves around a quarter of active websites globally.

The new releases address two vulnerabilities, of which the zero-day, tracked as CVE-2021-41773, is clearly the most pressing. It was identified and disclosed by Ash Daulton of the cPanel Security Team.

The flaw was found in a change made to path normalisation in the affected version of Apache, and it could allow an attacker to use a path traversal attack to map URLs to files outside the expected document root.

Apache said that if files outside of the document root aren’t protected by “require all denied”, such requests can succeed, and furthermore, the flaw can leak the source of interpreted files, such as CGI scripts, to an attacker.

It only affects Apache 2.4.49, which dropped on 15 September, so users who have not yet upgraded to this version are not affected, and should skip straight to 2.4.50.

Multiple cyber researchers say they have already reproduced CVE-2021-41773, and proof-of-concept exploits are circulating.

Sonatype’s Ax Sharma said that coupled with a separate issue, also reported earlier this week, in which misconfigured Apache Airflow servers were found to be leaking thousands of credentials, the incident demonstrated the importance of prompt patching.

“Path traversal flaws are not to be underestimated,” said Sharma. “Despite repeated reminders and advisories issued by Fortinet, the years-old VPN firewall vulnerability (CVE-2018-13379) continues to be exploited even today, because many entities are behind on patching,” he noted.

“This year, attackers exploited the Fortinet path traversal flaw to leak passwords from over 500,000 VPNs. That’s 10 times the number of VPN firewalls that were compromised last year through the same exploit,” he said.

Sharma said there were three takeaways from such an incident, namely:

• That active exploitation quickly follows disclosures, even where the process has been well coordinated and responsibly managed;
• That attackers will be constantly eyeing up public exploits and scanning for vulnerable instances – a Shodan search reveals over 100,000 instances of Apache HTTP Server 2.4.49, 4,000 in the UK;
• And that not every fix is always sufficient just because an issuer says it is – threat actors can often find workarounds.