Apache patch a zero-day flaw exploited in the wild

Apache has addressed two vulnerabilities, one of which is a path traversal and file disclosure flaw in its HTTP server actively exploited in the wild.

Apache has rolled out security patches to address two flaws, including a path traversal and file disclosure issue in its HTTP server that is actively exploited in the wild.

The two vulnerabilities have been tracked as CVE-2021-41773 and CVE-2021-41524.

The first issue, tracked as CVE-2021-41773, is a path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49. An attacker can trigger the flaw to map URLs to files outside the expected document root.

“A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root.” reads the advisory. “If files outside of the document root are not protected by “require all denied” these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts.”

The vulnerability affects only Apache 2.4.49, earlier versions are not impacted. The vulnerability was reported by Ash Daulton along with the cPanel Security Team. According to the advisory, the issue is known to be exploited in the wild.

Apache also addressed a null pointer dereference in HTTP/2 fuzzing tracked as CVE-2021-41524.

“While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request.” reads the advisory.

An attack can trigger the flaw to perform a denial-of-service (DoS) attack on the server.

The flaw was recently introduced in version 2.4.49.

Users are recommended to install the patches immediately, a growing number of threat actors could start exploiting the flaw in the coming weeks.

Security experts at Positive Technologies announced to have already reproduced the CVE-2021-41773 flaw.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Apache)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.