Pierluigi Paganini April 05, 2019

Security experts at Rapid7 have discovered that over 2 million Apache HTTP servers are still affected by the CVE-2019-0211 critical privilege escalation flaw.

An important privilege escalation vulnerability (CVE-2019-0211) affecting the Apache HTTP server could be exploited by users with the right to write and run scripts to gain root on Unix systems via scoreboard manipulation.

The flaw was discovered by Charles Fol and impacts all Apache HTTP Server releases from 2.4.17 to 2.4.38. The it has been addressed with the release of Apache httpd 2.4.39

“In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.” reads the changelog.

The CVE-2019-0211 vulnerability poses severe risks when the web server is used for running shared hosting instances, in this scenario, users with limited permissions could exploit the flaw to get root privileges using scripts and run commands on vulnerable Apache web servers.

Unfortunately, the vulnerability in Apache HTTP Server has been found and patched, but the sheer still impacts a large number of servers running older, unpatched versions. Hundreds of thousands of websites and servers could still be potentially exposed to cyber attacks exploiting the issue.

According to an analysis conducted by Rapid7, more than 2,000,000 servers, many on public cloud platforms, are still running vulnerable versions of Apache. Most of the flawed systems are in the United States (~770,000), Germany (~224,000), and France (~111,000).

“We found roughly 2 million distinct systems vulnerable to CVE-2019-0211 in our most recent HTTP scans, with 50% of them residing in the “usual suspects” (big cloud-hosting providers).” states the blog post published by Rapid7,

Even if the CVE-2019-0211 is not a remote code execution (RCE) vulnerability, it represents a serious threat to shared hosting providers that run multiple websites under the sale Apache process. 

“Organizations should consider applying Apache’s fix as soon as possible. And, if organizations host their website(s) in a shared hosting context impacted by this exposure, they should encourage their provider to patch as quickly as possible or consider moving to a different provider/platform.” suggests Rapid7.

At the time, Rapid7 Labs is not aware of any exploitation of this vulnerability

Pierluigi Paganini

(SecurityAffairs – CVE-2019-0211, Apache)

[adrotate banner=”5″]

[adrotate banner=”13″]