{"id":43281,"date":"2021-10-07T23:49:49","date_gmt":"2021-10-07T23:49:49","guid":{"rendered":"http:\/\/3d5d62e0-dbb5-47e6-98e1-cdb7d92e84bd"},"modified":"2021-10-07T23:49:49","modified_gmt":"2021-10-07T23:49:49","slug":"additional-fixes-released-addressing-apache-http-server-issue","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/additional-fixes-released-addressing-apache-http-server-issue\/","title":{"rendered":"Additional fixes released addressing Apache HTTP Server issue"},"content":{"rendered":"

Apache released<\/a> additional fixes for CVE-2021-41773 on Thursday as government agencies like CISA warned that one vulnerability related to the Apache HTTP Server issue had been exploited in the wild. <\/p>\n

As ZDNet reported<\/a> on Wednesday, developers behind the Apache HTTP Server Project urged users to apply a fix immediately to resolve a zero-day vulnerability. <\/p>\n

The Apache Software Foundation released<\/a> Apache HTTP Server version 2.4.50 to address two vulnerabilities that would allow an attacker to take control of an affected system. In a notice<\/a> on Wednesday, CISA said one of the vulnerabilities, CVE-2021-41773<\/a>, has already been exploited in the wild.<\/p>\n

“It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration “require all denied”, these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution,” Apache said in a notice.<\/p>\n

“This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.”<\/p>\n

CISA said<\/a> that “active scanning of Apache HTTP Server CVE-2021-41773 & CVE-2021-42013 is ongoing and expected to accelerate, likely leading to exploitation.” <\/p>\n

“These vulnerabilities have been exploited in the wild. Please patch immediately if you haven’t already — this cannot wait until after the weekend,” the government agency added. <\/p>\n

<\/section>\n

According to Bleeping Computer<\/a>, about 25% of websites worldwide<\/a> are backed by the open-source, cross-platform Apache HTTP Server. <\/p>\n

Sonatype researchers<\/a> said that approximately 112,000 Apache servers are running the vulnerable version, with roughly 40% located in the United States. Rapid7 Labs said<\/a> it identified about 65,000 potentially vulnerable versions of Apache httpd exposed to the public internet on Wednesday. <\/p>\n

Researchers say<\/a> the issue is actively being scanned<\/a> for in the wild.<\/p>\n

\"map3-1-1024x635.png\"<\/span>