Apache HTTP Server 2.4 Vulnerability: Redirects Misconfiguration Leading to Unexpected URL Redirection
Summary
ALPINE-CVE-2020-1927: In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request U... Affects apache2 versions < 2.4.43-r0. Fixed in 2.4.43-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables users to serve web content. It is known for its flexibility, power, and extensive feature set, including support for various modules that enhance its functionality. However, versions 2.4.0 to 2.4.41 are vulnerable to a specific issue where redirects configured with mod_rewrite can be manipulated through encoded newlines, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the way Apache HTTP Server handles redirects configured with mod_rewrite. When encoded newlines are present in the request URL, the server may be tricked into redirecting to an unintended URL, which can lead to phishing attacks or unauthorized access to sensitive information. This issue affects a range of Apache versions, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
2.4.43-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using mod_rewrite for redirects that may be affected by encoded newlines until they can apply the patch. Additionally, validating and sanitizing input URLs can help mitigate the risk of exploitation.
Conclusion
The vulnerability in Apache HTTP Server versions 2.4.0 to 2.4.41 poses a significant risk due to the potential for unauthorized URL redirection. Users are strongly advised to update to the patched version to ensure their systems remain secure. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for apache2 →
FAQ
Versions 2.4.0 to 2.4.41 of Apache HTTP Server are affected by this vulnerability.
The CVSS score of this vulnerability is 6.1, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized URL redirection, potentially resulting in phishing attacks or exposure of sensitive information.
Yes, the permanent fix is to update to Apache HTTP Server version 2.4.43-r0 or later, which addresses this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
