Denial of Service in Apache HTTP Server
Summary
CVE-2022-29404: In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Affects apache2 across 2 version ranges.
< 2.4.54-r0
< 4654faee107e0c3a830c204a1dc94700705e8e86
Fixed in 2.4.54-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software. It provides a robust and flexible platform for hosting websites and applications. The vulnerability identified as CVE-2022-29404 affects Apache HTTP Server versions 2.4.53 and earlier. This vulnerability can be exploited by sending a malicious request to a Lua script that calls the 'r:parsebody(0)' function. The lack of a default limit on the input size can lead to a denial of service (DoS) attack.
Vulnerability Detail
The CVE-2022-29404 vulnerability in Apache HTTP Server allows an attacker to launch a DoS attack by sending a specially crafted request to a Lua script. By exploiting the 'r:parsebody(0)' function, the attacker can cause the server to consume excessive resources, leading to a complete service disruption. This vulnerability does not require any authentication or user interaction, making it particularly dangerous. The impact of a successful attack can range from temporary unavailability of the server to a complete system crash.
How To Fix
Minimum fixed version
2.4.54-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented. This involves modifying the Lua script to include a limit on the input size. By adding a check to ensure that the input does not exceed a certain threshold, the risk of a DoS attack can be mitigated. Here is an example of how the Lua script can be modified:
function handle_request()
local input = r:parsebody(0)
if string.len(input) > MAX_INPUT_SIZE then
-- Handle the error or reject the request
else
-- Process the input
end
end
Replace 'MAX_INPUT_SIZE' with the desired limit for the input size.
Conclusion
The CVE-2022-29404 vulnerability in Apache HTTP Server poses a significant risk of denial of service attacks. It is crucial to promptly update to the latest version of Apache HTTP Server (2.4.54 or later) to mitigate this vulnerability. Implementing the recommended workaround, if immediate upgrading is not feasible, can provide temporary protection. Regularly monitoring for security updates and following best practices for software maintenance are essential to ensure the security and stability of web servers.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server is an open-source web server software that powers a significant portion of websites on the internet. It provides a reliable and scalable platform for hosting web applications.
A denial of service attack is a malicious attempt to disrupt the normal functioning of a computer system or network. By overwhelming the target with a high volume of requests or consuming excessive resources, the attacker aims to render the system unavailable to legitimate users.
The CVE-2022-29404 vulnerability in Apache HTTP Server allows an attacker to launch a denial of service attack by exploiting a Lua script. By sending a specially crafted request that triggers the 'r:parsebody(0)' function, the attacker can cause the server to consume excessive resources and become unresponsive.
No, authentication is not required to exploit the CVE-2022-29404 vulnerability. An attacker can send a malicious request to a vulnerable server without any authentication or user interaction.
To protect your Apache HTTP Server, it is recommended to upgrade to version 2.4.54 or later. This version includes a fix for the CVE-2022-29404 vulnerability by enforcing a default limit on the input size. Regularly updating and patching software is crucial for maintaining security.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
