SUBJECT: CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF)
TECH STACK: Apache HTTP Server versions 2.4.1 to 2.4.46.
DATE(S) ISSUED: 09/16/2021
CVE-2021-40438 is a vulnerability in the Apache HTTP Server that allows an attacker to send a malicious request from a server, causing the server to initiate requests to arbitrary, potentially internal, destinations. This is known as a server-side request forgery (SSRF) attack.
An attacker could exploit this vulnerability to access internal resources on the server that may not be directly accessible from the Internet, such as intranet websites or internal network resources. They could also potentially use the vulnerability to bypass firewall rules or to perform port scans of internal systems.
The vulnerability exists in the Apache HTTP Server's mod_proxy module, which is responsible for proxying requests from the server to other destinations. The vulnerability allows an attacker to send a specially crafted request that includes a malicious URL in the "Host" header, which can cause the server to send a request to an internal destination specified in the URL.
Apache HTTP Server versions 2.4.1 to 2.4.46 are affected by this vulnerability.
NIST Description: A crafted request uri-path can cause mod_proxy to forward the request to an origin server chosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CISA has added CVE-2021-40438 to its Known Exploited Vulnerabilities Catalog, based
on evidence that threat actors are actively exploiting the vulnerability. This vulnerability is a frequent attack vector for malicious cyber actors of all types and poses significant risk to the federal enterprise.
Base Score: 9.0 CRITICAL
To fix the CVE-2021-40438 vulnerability in the Apache HTTP Server, you should upgrade to a fixed version of the software. The specific version you should upgrade to will depend on which version of the Apache HTTP Server you are currently using.
The following versions of the Apache HTTP Server include a fix for the vulnerability:
To upgrade to a fixed version of the Apache HTTP Server, you can download the latest version of the software from the Apache HTTP Server download page (http://httpd.apache.org/download.cgi). Once you have downloaded the software, follow the instructions provided in the installation guide to install the new version.
Alternatively, you may be able to upgrade to a fixed version of the Apache HTTP Server using your operating system's package manager. Consult the documentation for your operating system or package manager for more information on how to upgrade software packages.
It is important to note that upgrading to a fixed version of the Apache HTTP Server will not automatically fix the vulnerability on your system. You will also need to ensure that any third-party modules or customizations you have made to the Apache HTTP Server are compatible with the new version.
CISCO:20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021
MLIST:[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update
MLIST:[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression
MLIST:[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info
MLIST:[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info
MLIST:[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info
MLIST:[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info
MLIST:[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438
MLIST:[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438