Apache HTTP Server 2.4.7-2.4.51: Crafted URI can cause crash or Server Side Request Forgery
Summary
CVE-2021-44224: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be... Affects apache2 across 2 version ranges.
< 2.4.52-r0
>= f2b561181dbd0c689fd583c60878ce05854ec5f9, < fed3b8a079835cd63648d8903bc69243ce2c472a
Fixed in 2.4.52-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software. It provides a reliable and secure platform for hosting websites and applications. However, versions 2.4.7 to 2.4.51 of Apache HTTP Server are vulnerable to a critical security issue.
Vulnerability Detail
The vulnerability, identified as CVE-2021-44224, allows an attacker to send a specially crafted URI to the server configured as a forward proxy. This can lead to a crash, resulting in a NULL pointer dereference. Additionally, in configurations that mix forward and reverse proxy declarations, the vulnerability can enable requests to be directed to a declared Unix Domain Socket endpoint, leading to Server Side Request Forgery (SSRF) attacks. The impact of this vulnerability can be severe, potentially allowing an attacker to crash the server or manipulate requests to access internal resources.
How To Fix
Minimum fixed version
2.4.52-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Apache HTTP Server is not immediately feasible, a temporary workaround is to disable the ProxyRequests directive in the server configuration. This can be achieved by setting 'ProxyRequests Off' in the Apache configuration file. However, it is crucial to note that this workaround may impact the functionality of the server as it disables the forward proxy feature.
Conclusion
The vulnerability in Apache HTTP Server versions 2.4.7 to 2.4.51 can have severe consequences, including server crashes and Server Side Request Forgery (SSRF) attacks. It is crucial to update to version 2.4.52 or later to mitigate the risk. If immediate updates are not possible, disabling the ProxyRequests directive can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server is an open-source web server software widely used for hosting websites and applications.
Versions 2.4.7 to 2.4.51 of Apache HTTP Server are affected by this vulnerability.
The vulnerability can result in a crash (NULL pointer dereference) or enable Server Side Request Forgery (SSRF) attacks, allowing unauthorized access to internal resources.
To fix this vulnerability, update Apache HTTP Server to version 2.4.52 or later.
A temporary workaround is to disable the ProxyRequests directive in the server configuration by setting 'ProxyRequests Off' in the Apache configuration file.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
