Apache HTTP Server Vulnerability: Unexpected Matching Behavior with 'MergeSlashes OFF'
Summary
UBUNTU-CVE-2021-30641: Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'. Affects apache2 versions < 2.4.7-1ubuntu4.22+esm1. Fixed in 2.4.7-1ubuntu4.22+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely-used open-source web server software that enables users to serve web content. It is known for its flexibility, power, and wide range of features, including support for various programming languages and modules. However, certain versions of Apache HTTP Server are vulnerable to a specific issue that affects its handling of URL slashes, potentially leading to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-30641, affects Apache HTTP Server versions 2.4.39 to 2.4.46. It arises from unexpected matching behavior when the 'MergeSlashes' directive is set to OFF. This can lead to unintended access to resources, potentially allowing attackers to bypass security controls and access sensitive information. The vulnerability has a CVSS score of 5.3, indicating a medium level of severity.
How To Fix
Minimum fixed version
2.4.7-1ubuntu4.22+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can set the 'MergeSlashes' directive to ON in their Apache configuration file. This can be done by adding the following line to the Apache configuration:
MergeSlashes On
However, this may not be a permanent solution and should be followed by an update to the patched version.
Conclusion
The Apache HTTP Server vulnerability CVE-2021-30641 poses a significant risk due to unexpected matching behavior with the 'MergeSlashes OFF' setting. Users are strongly advised to update their Apache installations to the patched versions to mitigate potential security threats.
See every vulnerability recorded for apache2 →
FAQ
The vulnerability affects Apache HTTP Server versions 2.4.39 to 2.4.46.
The CVSS score of the vulnerability is 5.3, indicating a medium level of severity.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can check your application using the Vulert playground without any signup.
If you cannot update immediately, consider applying the workaround by setting 'MergeSlashes' to ON in your Apache configuration, but plan to update as soon as possible.
More information can be found in the official security notices and vulnerability databases, such as the Ubuntu Security Notices.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
