Pierluigi Paganini October 05, 2021

Apache has addressed two vulnerabilities, one of which is a path traversal and file disclosure flaw in its HTTP server actively exploited in the wild.

Apache has rolled out security patches to address two flaws, including a path traversal and file disclosure issue in its HTTP server that is actively exploited in the wild.

The two vulnerabilities have been tracked as CVE-2021-41773 and CVE-2021-41524.

The first issue, tracked as CVE-2021-41773, is a path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49. An attacker can trigger the flaw to map URLs to files outside the expected document root.

“A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root.” reads the advisory. “If files outside of the document root are not protected by “require all denied” these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts.”

The vulnerability affects only Apache 2.4.49, earlier versions are not impacted. The vulnerability was reported by Ash Daulton along with the cPanel Security Team. According to the advisory, the issue is known to be exploited in the wild.

Apache also addressed a null pointer dereference in HTTP/2 fuzzing tracked as CVE-2021-41524.

“While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request.” reads the advisory.

An attack can trigger the flaw to perform a denial-of-service (DoS) attack on the server.

The flaw was recently introduced in version 2.4.49.

Users are recommended to install the patches immediately, a growing number of threat actors could start exploiting the flaw in the coming weeks.

Security experts at Positive Technologies announced to have already reproduced the CVE-2021-41773 flaw.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Apache)

[adrotate banner=”5″]

[adrotate banner=”13″]