Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 11 Oct 2021 10:57:21 +0200
From: Yann Ylavic <ylavic.dev@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2021-42013: Path Traversal and Remote Code
 Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

On Sat, Oct 9, 2021 at 8:00 PM Roman Medina-Heigl Hernandez
<roman@...labs.com> wrote:
>
> I just wanted to clarify that the impact of both CVEs is exactly the
> same: RCE and/or arbitrary file read and/or none, depending on httpd
> config :-).

I appreciate this nuance in your tweetS. For completeness :) I'll note
that most configs (default, vendors, distros) are not vulnerable to
the RCE.
The removal of "<Directory/> require all denied" is an exploit httpd
can do nothing about. httpd provides default/examples config [3] and
docs (no "don't do that" there I concede).

> There's no difference between Apache 2.4.49 and 2.4.50 in
> that regard.

Ack.

>
> But reading the blog post by Stefan
> (https://github.com/icing/blog/blob/main/httpd-2.4.50.md) and Apache
> HTTP 2.4 vulns security page
> (https://httpd.apache.org/security/vulnerabilities_24.html) as well, I
> feel like you are associating the RCE impact to 2.4.50 and the arbitrary
> file read to 2.4.49. That's misleading. Examples:

I feel obligated to Alexander and reference [1], plain text of the
current httpd vulnerabilities (w.r.t. CVE-2021-42013 &
CVE-2021-41773), as of "Fri, 8 Oct 2021 15:44:24 +0200" [2].

>
> - blog post
>
> "Affection, 2.4.49" -> You go for arbitrary file read example.
>
> "Affection, 2.4.50" -> Then you go for RCE example.

The blog port has the form of a chronological post mortem (it happened
in this order from the httpd team POV), it's an editorial choice (by
Stefan) which makes sense to me as it describes the case progressively
and finally quite exhaustively.
It's not the same goal as the vulnerabilities page anyway.

>
> - security page

Please see [1], both CVEs are aligned now.

>
> I'm sure this is unintentional and yes, it's only matter of wording but
> it's kind of misleading, imho. I'd kindly advise for it to be fixed.

That's the case (I think) on the vulnerabilities page now.

> And
> I also take this opportunity to thank ASF and particularly the folks
> like Yann and Stefan whose work makes Apache httpd possible.
>
> C'u in apache-nosejob-202x.c !!! :-)

Thanks for the kind words! Well, I suppose :)

Regards;
Yann.


[1] https://httpd.apache.org/security/vulnerabilities_24.html (8 Oct) :
"""
critical: Path Traversal and Remote Code Execution in Apache HTTP
Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
(CVE-2021-42013)

    It was found that the fix for CVE-2021-41773 in Apache HTTP Server
2.4.50 was insufficient. An attacker could use a path traversal attack
to map URLs to files outside the directories configured by Alias-like
directives.

    If files outside of these directories are not protected by the
usual default configuration "require all denied", these requests can
succeed. If CGI scripts are also enabled for these aliased paths, this
could allow for remote code execution.

    This issue only affects Apache 2.4.49 and Apache 2.4.50 and not
earlier versions.

    Acknowledgements:

        Reported by Juan Escobar from Dreamlab Technologies
        Reported by Fernando Muñoz from NULL Life CTF Team
        Reported by Shungo Kumasaka
        Reported by Nattapon Jongcharoen

    Reported to security team    2021-10-06
    fixed by r1893977, r1893980, r1893982 in 2.4.x    2021-10-07
    Update 2.4.51 released    2021-10-07
    Affects    2.4.50, 2.4.49

critical: Path traversal and file disclosure vulnerability in Apache
HTTP Server 2.4.49 (CVE-2021-41773)

    A flaw was found in a change made to path normalization in Apache
HTTP Server 2.4.49. An attacker could use a path traversal attack to
map URLs to files outside the directories configured by Alias-like
directives.

    If files outside of these directories are not protected by the
usual default configuration "require all denied", these requests can
succeed. If CGI scripts are also enabled for these aliased paths, this
could allow for remote code execution.

    This issue is known to be exploited in the wild.

    This issue only affects Apache 2.4.49 and not earlier versions.

    Acknowledgements: This issue was reported by Ash Daulton along
with the cPanel Security Team
    Reported to security team    2021-09-29
    fixed by r1893775 in 2.4.x    2021-10-01
    Update 2.4.50 released    2021-10-04
    Affects    2.4.49
"""

[2] https://github.com/apache/httpd-site/commit/74a166fab7443838c660c88df81961ddaa8df7fd.patch
:
"""
Date: Fri, 8 Oct 2021 15:44:24 +0200
Subject: [PATCH] Revert "Trigger rebuild"

This reverts commit 151e1ff7cdacf68fc615cc1513dbf81b8f307907.
---
 content/security/json/CVE-2021-42013.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/content/security/json/CVE-2021-42013.json
b/content/security/json/CVE-2021-42013.json
index 09b4792..31e9295 100644
--- a/content/security/json/CVE-2021-42013.json
+++ b/content/security/json/CVE-2021-42013.json
@@ -112,4 +112,3 @@
     }
   ]
 }
-
"""
To make sure every single byte was published :)

[3] https://github.com/apache/httpd/blob/2.4.x/docs/conf/httpd.conf.in#L110 :
"""
#
# Deny access to the entirety of your server's filesystem. You must
# explicitly permit access to web content directories in other
# <Directory> blocks below.
#
<Directory />
    AllowOverride none
    Require all denied
</Directory>
"""

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.