Apache HTTP Server Vulnerability: CVE-2021-44224 - Potential Crash and SSRF Risk
Summary
UBUNTU-CVE-2021-44224: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be... Affects apache2 versions < 2.4.7-1ubuntu4.22+esm3. Fixed in 2.4.7-1ubuntu4.22+esm3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache, is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, robust feature set, and strong community support. The software is designed to handle various web protocols and can be configured to serve both static and dynamic content. However, Apache has been found to be vulnerable to CVE-2021-44224, which affects versions up to 2.4.51. This vulnerability arises from improper handling of crafted URIs when configured as a forward proxy, potentially leading to server crashes or unauthorized access to local resources.
Vulnerability Detail
CVE-2021-44224 is a vulnerability in Apache HTTP Server that allows a crafted URI sent to a server configured as a forward proxy (with ProxyRequests enabled) to cause a crash due to a NULL pointer dereference. Additionally, in configurations that mix forward and reverse proxy declarations, this vulnerability can enable Server Side Request Forgery (SSRF) attacks, allowing requests to be directed to Unix Domain Socket endpoints. This issue affects Apache HTTP Server versions 2.4.7 through 2.4.51, posing significant security risks to affected systems.
How To Fix
Minimum fixed version
2.4.7-1ubuntu4.22+esm3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the ProxyRequests directive in your Apache configuration to mitigate the risk of this vulnerability until a patch can be applied. This can be done by editing the Apache configuration file (usually located at /etc/apache2/apache2.conf) and commenting out or removing the line:
ProxyRequests On
Then, restart Apache to apply the changes:
sudo systemctl restart apache2
Conclusion
CVE-2021-44224 is a significant vulnerability affecting Apache HTTP Server that can lead to server crashes and SSRF risks. It is crucial for users to update to the latest patched versions of Apache to mitigate these risks. Temporary workarounds are available, but applying the updates is the best long-term solution.
See every vulnerability recorded for apache2 →
FAQ
CVE-2021-44224 is a vulnerability in Apache HTTP Server that can lead to server crashes and potential SSRF attacks.
Apache HTTP Server versions 2.4.7 through 2.4.51 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score of CVE-2021-44224 is 8.2, indicating a high severity level.
If an immediate update is not possible, disable the ProxyRequests directive in your Apache configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
