Red Hat Bugzilla – Bug 1623265
CVE-2011-2767 mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess
Last modified: 2018-09-27 06:57:57 EDT
A flaw was found in mod_perl 2.0 through 2.0.10 which allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes. References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=644169
Created mod_perl tracking bugs for this issue: Affects: epel-7 [bug 1623268] Affects: fedora-all [bug 1623267]
Reproducer: (1) Enable user's ~/public_html directories in httpd configuration (add "UserDir public_html" directive to /etc/httpd/conf.d/userdir.conf) and enable httpd_enable_homedirs SELinux boolean. (2) Add to ~/public_html/.htaccess: <Perl> warn "HIT"; </Perl> (3) Request <http://localhost/~<USER>/> document. (4) Check /var/log/httpd/error_log for Perl's "HIT" warning message, e.g. # tail -n 1 error_log HIT at /home/test/public_html/.htaccess line 2. A <USER> can write any arbitrary text to /var/log/httpd/error_log. Proposed fix: The <Perl> section should not be supported in .htaccess files at all as is documented in <http://perl.apache.org/docs/2.0/user/config/config.html#mod_perl_Directives_Argument_Types_and_Allowed_Location>. A fix proposed at <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=644169#19> does that. This a bug in mod_perl implementation. This not about missing or malfunctioning "PerlOption -Sections" directive. This is about <Perl> sections being erroneously processed in <Directory>, <Location>, <Files> section, and .htaccess files.
Thanks for the reproduction notes ppisar. Quite easy to reproduce and gain code execution as the apache process. As a note, SELinux does technically mitigate this in that the UserDir functionality will not work without specific selinux booleans (httpd_enable_homedirs and perhaps httpd_read_user_content). However, it is unlikely that anyone would enable UserDir and not set the corresponding selinux flags as the functionality would obviously not work until the booleans are set. Seems like this flaw could impact shared hosting the most. My guess is that a good mitigation now is to disable UserDir functionality and potentially .htaccess processing via AllowOverride None.
Mitigation: Disabling the UserDir directive and also setting AllowOverride None should prevent the processing of perl in user .htaccess files.
Statement: The default configurations shipped in Red Hat Enterprise Linux 6 and Red Hat Software Collections are not vulnerable to to this flaw. The UserDir option needs to be enabled as well as AllowOverride being set to values other than "None" for this to potentially pose a threat.
mod_perl-2.0.10-9.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
mod_perl-2.0.10-11.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
mod_perl-2.0.10-3.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
mod_perl-2.0.10-13.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2018:2737 https://access.redhat.com/errata/RHSA-2018:2737
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Via RHSA-2018:2825 https://access.redhat.com/errata/RHSA-2018:2825
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Via RHSA-2018:2826 https://access.redhat.com/errata/RHSA-2018:2826