[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <9b8f4c6c-1a65-321a-c7e7-601700aeb34d@rs-labs.com>
Date: Fri, 15 Oct 2021 20:00:59 +0200
From: Roman Medina-Heigl Hernandez <roman@...labs.com>
To: Yann Ylavic <ylavic.dev@...il.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-2021-42013: Path Traversal and Remote Code
Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of
CVE-2021-41773)
Hi Yann,
Re [1], I think this:
"critical: Path traversal and file disclosure vulnerability in Apache
HTTP Server 2.4.49 (CVE-2021-41773
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773>)"
is still misleading and should read:
"critical: Path traversal and *Remote Code Execution* vulnerability in
Apache HTTP Server 2.4.49 (CVE-2021-41773
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773>)"
PS: Dear Alexander, feel free to drop this from OSS-ml if you think this
kind of detail is not relevant.
Cheers,
-r
El 11/10/2021 a las 10:57, Yann Ylavic escribió:
> On Sat, Oct 9, 2021 at 8:00 PM Roman Medina-Heigl Hernandez
> <roman@...labs.com> wrote:
>> I just wanted to clarify that the impact of both CVEs is exactly the
>> same: RCE and/or arbitrary file read and/or none, depending on httpd
>> config :-).
> I appreciate this nuance in your tweetS. For completeness :) I'll note
> that most configs (default, vendors, distros) are not vulnerable to
> the RCE.
> The removal of "<Directory/> require all denied" is an exploit httpd
> can do nothing about. httpd provides default/examples config [3] and
> docs (no "don't do that" there I concede).
>
>> There's no difference between Apache 2.4.49 and 2.4.50 in
>> that regard.
> Ack.
>
>> But reading the blog post by Stefan
>> (https://github.com/icing/blog/blob/main/httpd-2.4.50.md) and Apache
>> HTTP 2.4 vulns security page
>> (https://httpd.apache.org/security/vulnerabilities_24.html) as well, I
>> feel like you are associating the RCE impact to 2.4.50 and the arbitrary
>> file read to 2.4.49. That's misleading. Examples:
> I feel obligated to Alexander and reference [1], plain text of the
> current httpd vulnerabilities (w.r.t. CVE-2021-42013 &
> CVE-2021-41773), as of "Fri, 8 Oct 2021 15:44:24 +0200" [2].
>
>> - blog post
>>
>> "Affection, 2.4.49" -> You go for arbitrary file read example.
>>
>> "Affection, 2.4.50" -> Then you go for RCE example.
> The blog port has the form of a chronological post mortem (it happened
> in this order from the httpd team POV), it's an editorial choice (by
> Stefan) which makes sense to me as it describes the case progressively
> and finally quite exhaustively.
> It's not the same goal as the vulnerabilities page anyway.
>
>> - security page
> Please see [1], both CVEs are aligned now.
>
>> I'm sure this is unintentional and yes, it's only matter of wording but
>> it's kind of misleading, imho. I'd kindly advise for it to be fixed.
> That's the case (I think) on the vulnerabilities page now.
>
>> And
>> I also take this opportunity to thank ASF and particularly the folks
>> like Yann and Stefan whose work makes Apache httpd possible.
>>
>> C'u in apache-nosejob-202x.c !!! :-)
> Thanks for the kind words! Well, I suppose :)
>
> Regards;
> Yann.
>
>
> [1] https://httpd.apache.org/security/vulnerabilities_24.html (8 Oct) :
> """
> critical: Path Traversal and Remote Code Execution in Apache HTTP
> Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
> (CVE-2021-42013)
>
> It was found that the fix for CVE-2021-41773 in Apache HTTP Server
> 2.4.50 was insufficient. An attacker could use a path traversal attack
> to map URLs to files outside the directories configured by Alias-like
> directives.
>
> If files outside of these directories are not protected by the
> usual default configuration "require all denied", these requests can
> succeed. If CGI scripts are also enabled for these aliased paths, this
> could allow for remote code execution.
>
> This issue only affects Apache 2.4.49 and Apache 2.4.50 and not
> earlier versions.
>
> Acknowledgements:
>
> Reported by Juan Escobar from Dreamlab Technologies
> Reported by Fernando Muñoz from NULL Life CTF Team
> Reported by Shungo Kumasaka
> Reported by Nattapon Jongcharoen
>
> Reported to security team 2021-10-06
> fixed by r1893977, r1893980, r1893982 in 2.4.x 2021-10-07
> Update 2.4.51 released 2021-10-07
> Affects 2.4.50, 2.4.49
>
> critical: Path traversal and file disclosure vulnerability in Apache
> HTTP Server 2.4.49 (CVE-2021-41773)
>
> A flaw was found in a change made to path normalization in Apache
> HTTP Server 2.4.49. An attacker could use a path traversal attack to
> map URLs to files outside the directories configured by Alias-like
> directives.
>
> If files outside of these directories are not protected by the
> usual default configuration "require all denied", these requests can
> succeed. If CGI scripts are also enabled for these aliased paths, this
> could allow for remote code execution.
>
> This issue is known to be exploited in the wild.
>
> This issue only affects Apache 2.4.49 and not earlier versions.
>
> Acknowledgements: This issue was reported by Ash Daulton along
> with the cPanel Security Team
> Reported to security team 2021-09-29
> fixed by r1893775 in 2.4.x 2021-10-01
> Update 2.4.50 released 2021-10-04
> Affects 2.4.49
> """
>
> [2] https://github.com/apache/httpd-site/commit/74a166fab7443838c660c88df81961ddaa8df7fd.patch
> :
> """
> Date: Fri, 8 Oct 2021 15:44:24 +0200
> Subject: [PATCH] Revert "Trigger rebuild"
>
> This reverts commit 151e1ff7cdacf68fc615cc1513dbf81b8f307907.
> ---
> content/security/json/CVE-2021-42013.json | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/content/security/json/CVE-2021-42013.json
> b/content/security/json/CVE-2021-42013.json
> index 09b4792..31e9295 100644
> --- a/content/security/json/CVE-2021-42013.json
> +++ b/content/security/json/CVE-2021-42013.json
> @@ -112,4 +112,3 @@
> }
> ]
> }
> -
> """
> To make sure every single byte was published :)
>
> [3] https://github.com/apache/httpd/blob/2.4.x/docs/conf/httpd.conf.in#L110 :
> """
> #
> # Deny access to the entirety of your server's filesystem. You must
> # explicitly permit access to web content directories in other
> # <Directory> blocks below.
> #
> <Directory />
> AllowOverride none
> Require all denied
> </Directory>
> """
--
Saludos,
-Román
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
