CVE-2021-40438criticalunder attackransomwareCWE-918

CVE-2021-40438: critical vulnerability in Apache HTTP Server

mod_proxy SSRF

Published · Updated

Follow this CVE+ Monitor Apache HTTP Server+ Monitor Apache

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9epss 100%
from disclosure to weapon32 days
Published on NVDSep 16
1st PoC+32d
CISA KEV+76d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
32 products (532 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream EUS (v. 8.2) · Red Hat Enterprise Linux AppStream EUS (v. 8.1) · Red Hat JBoss Core Services on RHEL 8 · Red Hat JBoss Core Services on RHEL 7 Server · and others 27
fix ↗
Not affected
3 products (25 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 9 · Red Hat JBoss Enterprise Application Platform 6 · Red Hat Enterprise Linux 6
Action required by CISAfederal deadline: 2021-12-15

Apply updates per vendor instructions.

In short

Apache HTTP Server's mod_proxy module can be tricked into forwarding requests to servers of an attacker's choice through a specially crafted request path. This allows attackers to access internal systems or services that should not be publicly reachable.

Technical detail

Server-Side Request Forgery (SSRF) vulnerability in mod_proxy allows an unauthenticated remote attacker to manipulate the uri-path parameter to redirect proxied requests to arbitrary origin servers. Pre-condition: mod_proxy must be enabled; impact includes unauthorized access to internal resources, information disclosure, and potential lateral movement within the network infrastructure.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache HTTP Server
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache HTTP Server

In the same product, most dangerous first.

CVE-2021-41773HIGHPath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49EPSS 100.0%KEVCVE-2021-42013CRITICALPath Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)EPSS 100.0%KEVCVE-2024-38475CRITICALApache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.EPSS 100.0%KEVCVE-2021-44790—Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlierEPSS 96.8%CVE-2017-9798—CVE-2017-9798EPSS 94.7%CVE-2022-30522—mod_sed denial of serviceEPSS 89.9%