More than 2 million Apache HTTP servers still affected by CVE-2019-0211 flaw

Security experts at Rapid7 have discovered that over 2 million Apache HTTP servers are still affected by the CVE-2019-0211 critical privilege escalation flaw.

An important privilege escalation vulnerability (CVE-2019-0211) affecting the Apache HTTP server could be exploited by users with the right to write and run scripts to gain root on Unix systems via scoreboard manipulation.

The flaw was discovered by Charles Fol and impacts all Apache HTTP Server releases from 2.4.17 to 2.4.38. The it has been addressed with the release of Apache httpd 2.4.39

“In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.” reads the changelog.

The CVE-2019-0211 vulnerability poses severe risks when the web server is used for running shared hosting instances, in this scenario, users with limited permissions could exploit the flaw to get root privileges using scripts and run commands on vulnerable Apache web servers.

Unfortunately, the vulnerability in Apache HTTP Server has been found and patched, but the sheer still impacts a large number of servers running older, unpatched versions. Hundreds of thousands of websites and servers could still be potentially exposed to cyber attacks exploiting the issue.

According to an analysis conducted by Rapid7, more than 2,000,000 servers, many on public cloud platforms, are still running vulnerable versions of Apache. Most of the flawed systems are in the United States (~770,000), Germany (~224,000), and France (~111,000).

“We found roughly 2 million distinct systems vulnerable to CVE-2019-0211 in our most recent HTTP scans, with 50% of them residing in the “usual suspects” (big cloud-hosting providers).” states the blog post published by Rapid7,

Even if the CVE-2019-0211 is not a remote code execution (RCE) vulnerability, it represents a serious threat to shared hosting providers that run multiple websites under the sale Apache process.

“Organizations should consider applying Apache’s fix as soon as possible. And, if organizations host their website(s) in a shared hosting context impacted by this exposure, they should encourage their provider to patch as quickly as possible or consider moving to a different provider/platform.” suggests Rapid7.

At the time, Rapid7 Labs is not aware of any exploitation of this vulnerability

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – CVE-2019-0211, Apache)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.