[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 7 Oct 2021 06:01:43 +0000
From: "Tim Wadhwa-Brown (twadhwab)" <twadhwab@...co.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: RE: CVE-2021-41773: Path traversal and file disclosure
vulnerability in Apache HTTP Server 2.4.49
Hi oss-security folks,
Closing the loop on this one. Will Dormann, Hacker Fantastic and I successfully managed to turn this into RCE on both Windows and Linux. With mod_cgi (and maybe other similar extensions) enabled, Will showed he could get calc to pop on Windows and HF and I subsequently figured out how to trigger the bug on Linux to reach /bin/sh and POST a shell payload. Whilst the configuration may not be default it's probably worth doubling down on any efforts to get the patch rolled out if you're affected. There's a whole series of Twitter that I shan't bore you with but https://twitter.com/hackerfantastic/status/1445523890759819264?s=20 should be a good starting point if you want to read back.
Tim
PS Apologies for any email mangling, first time posting here in quite some time and sadly corporate mail client is no longer KMail ☹. Not sure if it will become a regular habit again.
Tim Wadhwa-Brown
Security Research Lead, CX Technology & Transformation Group
twadhwab@...co.com
Tel: +44 208 824 0239
Mail Stop UXB10/3
82 Oxford Road,
Uxbridge,
UB8 1UX,
United Kingdom
cisco.com | labs.portcullis.co.uk
-----Original Message-----
From: Stefan Eissing <icing@...che.org>
Sent: 05 October 2021 10:03
To: oss-security@...ts.openwall.com
Subject: [oss-security] CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
Severity: important
Description:
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root.
If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts.
This issue is known to be exploited in the wild.
This issue only affects Apache 2.4.49 and not earlier versions.
Credit:
This issue was reported by Ash Daulton along with the cPanel Security Team
References:
https://httpd.apache.org/security/vulnerabilities_24.html
Download attachment "PGP.sig" of type "application/pgp-signature" (822 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
