Critical Vulnerability in Apache2: Server Side Request Forgery and Crash Risk
Summary
ALPINE-CVE-2021-44224: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be... Affects apache2 versions < 2.4.52-r0. Fixed in 2.4.52-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, power, and extensive feature set, including support for various protocols and modules. However, certain configurations, particularly those involving forward proxy settings, can expose the server to vulnerabilities, such as the one identified in CVE-2021-44224.
Vulnerability Detail
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash due to a NULL pointer dereference. Additionally, in configurations that mix forward and reverse proxy declarations, this vulnerability can lead to Server Side Request Forgery (SSRF), allowing unauthorized requests to be directed to a declared Unix Domain Socket endpoint. This issue affects Apache HTTP Server versions 2.4.7 through 2.4.51, posing significant security risks to affected systems.
How To Fix
Minimum fixed version
2.4.52-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the ProxyRequests directive in your Apache configuration to prevent the exploitation of this vulnerability. This can be done by adding the following line to your Apache configuration file: 'ProxyRequests Off'. Restart the Apache service after making this change.
Conclusion
CVE-2021-44224 represents a significant security vulnerability in Apache HTTP Server that can lead to crashes and unauthorized access. It is crucial for users of affected versions to update to the patched version or implement workarounds to protect their systems.
See every vulnerability recorded for apache2 →
FAQ
CVE-2021-44224 is a vulnerability in Apache HTTP Server that can lead to a crash or Server Side Request Forgery when configured as a forward proxy.
The vulnerability affects Apache HTTP Server versions 2.4.7 to 2.4.51.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2021-44224 is 8.2, indicating a high severity level.
If an immediate update is not possible, consider disabling the ProxyRequests directive as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
