CVE-2021-44790CWE-787

CVE-2021-44790: vulnerability in Apache HTTP Server

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

Published · Updated

45Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 97%
from disclosure to weapon467 days
Published on NVDDec 20
1st PoC+467d
exploitation probability
97%top 1% of all CVEs
observed exploitation
nono source reports it
5 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (7 components)
Red Hat JBoss Enterprise Application Platform 6
workaround: Disabling mod_lua and restarting httpd will mitigate this flaw. See https://access.redhat.com/articles/10649 for more information.
Fixed
28 products (508 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream EUS (v. 8.2) · Red Hat Enterprise Linux AppStream EUS (v.8.4) · Red Hat Enterprise Linux AppStream E4S (v. 8.1) · Red Hat Enterprise Linux Server (v. 7) · and others 23
fix ↗
Not affected
3 products (19 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 6 · Red Hat JBoss Core Services
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
Affected products
Apache Software Foundation · Apache HTTP Server
public PoCs found — 5✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/51193githubgithub.com/nuPacaChi/-CVE-2021-44790★ 4githubgithub.com/CerberusMrXi/Apache-Lua-Buffer-Overflow-Exploit-CVE-2021-44790★ 1githubgithub.com/MohammadAliMehri/cve-2021-44790-lab★ 0cve_referencepacketstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache HTTP Server

In the same product, most dangerous first.

CVE-2021-40438CRITICALmod_proxy SSRFEPSS 100.0%KEVCVE-2021-41773HIGHPath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49EPSS 100.0%KEVCVE-2021-42013CRITICALPath Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)EPSS 100.0%KEVCVE-2024-38475CRITICALApache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.EPSS 100.0%KEVCVE-2017-9798—CVE-2017-9798EPSS 95.0%CVE-2024-27316HIGHApache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation framesEPSS 91.3%
References
http://httpd.apache.org/security/vulnerabilities_24.htmlhttp://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2022/May/33http://seclists.org/fulldisclosure/2022/May/35http://seclists.org/fulldisclosure/2022/May/38https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20211224-0001/https://support.apple.com/kb/HT213255