首页
学习
活动
专区
工具
TVP
发布
社区首页 >专栏 >新洞速递(CVE-2021-41773)

新洞速递(CVE-2021-41773)

作者头像
用户5878089
发布2021-10-11 10:27:47
8590
发布2021-10-11 10:27:47
举报

Description

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.

Apache Web Server Zero-Day Actively Exploited, Exposes Sensitive Data | Threatpost

Apache Web Server Zero-Day Exposes Sensitive Data

img

The open-source project has rolled out a security fix for CVE-2021-41773, for which public cyberattack exploit code is circulating.

Apache Software has quickly issued a fix for a zero-day security bug in the Apache HTTP Server, which was first reported to the project last week. The vulnerability is under active exploitation in the wild, it said, and could allow attackers to access sensitive information.

According to a security advisory issued on Monday, the issue (CVE-2021-41773) could allow path traversal and subsequent file disclosure. Path traversal issues allow unauthorized people to access files on a web server, by tricking either the web server or the web application running on it into returning files that exist outside of the web root folder.

The vulnerability is rated Important, with a CVSS score of 5.1 out of 10.

In this case, the issue affects only version 2.4.49 of Apache’s open-source web server, which offers cross-platform operability with all modern operating systems, including UNIX and Windows.

“A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49,” according to the advisory. “An attacker could use a path-traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by ‘require all denied,’ these requests can succeed.”

The bug could also expose the source of interpreted files like CGI scripts, the advisory added, which which may contain sensitive information that attackers can exploit for further attacks.

Researchers such as the offensive team at Positive Technologies quickly created proof-of-concept exploits verifying the attack path, so expect more attack avenues to be availably publicly soon:

CODE

1633506312033

POC

GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd

Some URL

https://mp.weixin.qq.com/s/XEnjVwb9I0GPG9RG-v7lHQ

https://mp.weixin.qq.com/s/cXUZD2W_FpFWxpGRaexDHA

本文参与 腾讯云自媒体分享计划,分享自微信公众号。
原始发表:2021-10-06,如有侵权请联系 cloudcommunity@tencent.com 删除

本文分享自 无级安全 微信公众号,前往查看

如有侵权,请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体分享计划  ,欢迎热爱写作的你一起参与!

评论
登录后参与评论
0 条评论
热度
最新
推荐阅读
目录
  • Description
  • Apache Web Server Zero-Day Exposes Sensitive Data
  • CODE
  • POC
  • Some URL
领券
问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档