Apache HTTP Server Vulnerability: Unexpected Matching Behavior in apache2
Summary
ALPINE-CVE-2021-30641: Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'. Affects apache2 versions < 2.4.48-r0. Fixed in 2.4.48-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache, is one of the most widely used web server software applications. It provides a robust and flexible platform for serving web content, supporting various features such as URL redirection, authentication, and SSL/TLS encryption. The vulnerability identified as CVE-2021-30641 affects versions 2.4.39 to 2.4.46 of Apache HTTP Server, specifically related to its handling of URL paths when the 'MergeSlashes' directive is set to OFF. This issue can lead to unexpected behavior in URL matching, potentially exposing sensitive information or allowing unauthorized access.
Vulnerability Detail
The vulnerability arises from an unexpected matching behavior in Apache HTTP Server when the 'MergeSlashes' directive is set to OFF. This can lead to improper handling of URL paths, which may allow attackers to bypass security controls or access restricted resources. The affected versions of Apache (2.4.39 to 2.4.46) do not properly validate URL paths, which can result in security implications such as information disclosure or unauthorized access to files and directories. The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.4.48-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set the 'MergeSlashes' directive to ON in your Apache configuration file. This can be done by adding the following line to your Apache configuration: 'MergeSlashes ON'. However, this is not a permanent fix and updating to the patched version is strongly recommended.
Conclusion
In summary, CVE-2021-30641 is a significant vulnerability affecting Apache HTTP Server versions 2.4.39 to 2.4.46, leading to unexpected URL matching behavior. It is crucial to update to the patched version 2.4.48-r0 or later to mitigate risks. Temporary workarounds are available, but they do not replace the need for a proper update.
See every vulnerability recorded for apache2 →
FAQ
CVE-2021-30641 is a vulnerability in Apache HTTP Server that affects versions 2.4.39 to 2.4.46, related to unexpected matching behavior with the 'MergeSlashes' directive set to OFF.
The risks include unauthorized access to sensitive information and potential bypassing of security controls, which can lead to data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing the temporary workaround by setting 'MergeSlashes' to ON, but plan to update as soon as possible.
More information can be found in the official CVE database or the Alpine Linux security advisories related to this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
