Apache HTTP Server Vulnerability: Redirects Misconfiguration Due to Encoded Newlines
Summary
ALPINE-CVE-2019-10098: In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. Affects apache2 versions < 2.4.41-r0. Fixed in 2.4.41-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache, is one of the most widely used web server software applications. It provides a robust and flexible platform for serving web content and is known for its modular architecture, allowing users to extend its functionality through various modules. However, certain configurations, particularly those involving mod_rewrite, can lead to vulnerabilities if not properly managed. This specific vulnerability affects versions 2.4.0 to 2.4.39, where misconfigured redirects can be exploited due to encoded newlines in the request URL.
Vulnerability Detail
The vulnerability, identified as CVE-2019-10098, arises from the way Apache handles redirects configured with mod_rewrite. When these redirects are intended to be self-referential, they can be manipulated by attackers using encoded newlines, leading to unexpected URLs being generated. This could potentially redirect users to malicious sites or expose sensitive information, posing a significant security risk. The vulnerability affects a wide range of Apache versions, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
2.4.41-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can review their mod_rewrite configurations to ensure that redirects do not allow encoded newlines. This may involve sanitizing input or implementing stricter validation rules to prevent such manipulations.
Conclusion
In summary, CVE-2019-10098 is a significant vulnerability affecting Apache HTTP Server versions 2.4.0 to 2.4.39, allowing for potential exploitation through misconfigured redirects. Users are strongly advised to update to version 2.4.41-r0 or later to mitigate this risk. Additionally, reviewing configurations can provide temporary relief until updates are applied.
See every vulnerability recorded for apache2 →
FAQ
CVE-2019-10098 is a vulnerability in Apache HTTP Server that allows attackers to exploit misconfigured redirects using encoded newlines.
The vulnerability affects Apache HTTP Server versions 2.4.0 to 2.4.39.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 6.1, indicating a medium severity level.
If immediate updates are not possible, review and modify your mod_rewrite configurations to prevent encoded newlines from being processed in redirects.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
