Tuesday, March 19, 2024

Apache HTTP Server 0-Day Bug Exploited in Wild – PoC Exploit Released

Apache released a security update with the fixes of the Critical Zero-day vulnerability in Apache HTTP Server 2.4.49 that was exploited in Wide. Users recommended updating the new version Fixed in Apache HTTP Server 2.4.50.

The Apache HTTP Server is a free and open-source cross-platform web server software, released under the terms of Apache License 2.0 With 25% Market share.

Researchers uncovered a Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 which is widely exploited.

The vulnerability (CVE-2021-41773) found in a change made to path normalization in Apache HTTP Server 2.4.49 allows an attacker to use a path traversal attack to map URLs to files outside the expected document root.

“If files outside of the document root are not protected by “require all denied” these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts.”Apache said .

Also fixed another vulnerability (CVE-2021-41524) in 2.4.49 While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing by attackers with the help of a specially crafted request that allows an external source to DoS the server.

Remote Code Execution Abilities (CVE-2021-41773)

PoC-Exploit has been released for this Path traversal and file disclosure vulnerability, in which researchers also found that the vulnerability is more critical than it was that allowing attackers to perform remote code execution (RCE).

There are 112,755 Apache Server 2.4.49 running hosts found vulnerable, also by taking advantage of this vulnerability, Attackers can abuse Apache servers running version 2.4.49 not only to read arbitrary files but also to execute arbitrary code on the servers.

Security researcher with the name of Hacker Fantastic in Twitter has released a POC-Exploit which can be used for this attack by upload a file via a path traversal exploit, and set execute permissions on the file that gives them an ability to execute an arbitrary code remotely.

He also pointed that “Exploiting CVE-2021-41773 to execute commands is incredibly easy once mod-cgi has been enabled”

Also, he stated that “There is no need to upload a file on Linux/UNIX type environments and mess with file permissions (although that would work too) – you can exploit this with a simple POST request and run full commands + arguments by passing commands as env vars to /bin/sh”

All the server administrators should ensure their Apache HTTP server environments are running patched versions 2.4.50 and above, also use the  Sigma rules to help detect an active exploit for the zero-day.

Website

Latest articles

CryptoWire Ransomware Attacking Abuses Schedule Task To maintain Persistence

AhnLab security researchers detected a resurgence of CryptoWire, a ransomware strain originally prevalent in...

E-Root Admin Sentenced to 42 Months in Prison for Selling 350,000 Credentials

Tampa, FL – In a significant crackdown on cybercrime, Sandu Boris Diaconu, a 31-year-old...

WhiteSnake Stealer Checks for Mutex & VM Function Before Execution

A new variant of the WhiteSnake Stealer, a formidable malware that has been updated...

Researchers Hack AI Assistants Using ASCII Art

Large language models (LLMs) are vulnerable to attacks, leveraging their inability to recognize prompts...

Microsoft Deprecate 1024-bit RSA Encryption Keys in Windows

Microsoft has announced an important update for Windows users worldwide in a continuous effort...

Beware Of Free wedding Invite WhatsApp Scam That Steal Sensitive Data

The ongoing "free wedding invite" scam is one of several innovative campaigns aimed at...

Hackers Using Weaponized SVG Files in Cyber Attacks

Cybercriminals have repurposed Scalable Vector Graphics (SVG) files to deliver malware, a technique that...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles