On October 5, 2021, the Apache Software Foundation provided an update that patched CVE-2021-41773. This vulnerability is a path normalization issue that can be leveraged to read arbitrary files and in some cases execute remote code in Apache’s widely adopted HTTP Server. It affects version 2.4.49 only but is actively being exploited in the wild and Randori has found numerous matching versions exposed on internet-facing assets.  

The Randori Attack Team has successfully developed a reliable working exploit, tested it in a lab environment and began leveraging the capability as part of Randori’s continuous and automated red team platform. Under the right configuration settings, this vulnerability is trivial to exploit and affected organizations should patch immediately. 

For defenders looking for a way to understand if they are impacted, the Randori Attack Team has provided details on the non-default configurations required for successful exploitation and steps organizations can take to test for the vulnerability.

Exploitable Configurations

To successfully exploit CVE-2021-41773, Apache 2.4.49 must be set up in a non-default configuration.

There are two configuration patterns that are susceptible to two different exploitation techniques:

1. If mod_cgi is enabled and “require all granted” is applied to the default Directory block, then an attacker can execute remote code with permissions of the user running Apache.
2. If mod_cgi is not enabled and “require all granted” is applied to the default Directory block, then an attacker can read arbitrary files with permissions of the user running Apache.

If a system has these configurations exploitation of this vulnerability is trivial. If “require all granted” is present for any path exploitation may be possible and other cases may exist. Randori recommends upgrading to Apache 2.4.50.

How To Test For Vulnerability

Scenario 1: Vulnerable to Remote Code Execution

Example of remote code execution on a system with mod_cgi enabled. 

Scenario 2: Vulnerable to File Inclusion

Example of reading a file on a vulnerable system without mod_cgi enabled.

Scenario 2: Vulnerable to File Inclusion but not Remote Code Execution

Example of trying to run a command on a system that is vulnerable to file disclosure but does not have mod_cgi enabled.

Recommended Actions

Based on our research, we can confirm that for organizations running Apache 2.4.49 with a vulnerable configuration this issue is serious and action should be taken to ensure the security of impacted devices. 

The vulnerability was made public on October 5; therefore, organizations running instances of Apache 2.4.49 exposed to the Internet from that date forward should assume that an adversary may have gained access to their network. Randori recommends reviewing historical logs for anomalous behavior such as abnormal URL paths, source IP connections, and other signs of compromise.  

Organizations unsure of their exposure or looking to confirm their risk can request a free attack surface audit from Randori. This personalized assessment will analyze your organized exposed internet-facing asset and provide a custom assessment of your most tempting access and recommendations on how to reduce your risk.   

Sources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
• https://twitter.com/hackerfantastic/status/1445531829985968137