Bug 2005117 (CVE-2021-40438) - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:"
Summary: CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted request uri-path containi...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-40438
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2005118 2007231 2007232 2007233 2007234 2007235 2007236 2007237 2007238 2007239 2009780 2009781 2011724 2011725 2011726 2011727 2011728 2011729 2078980 2078981 2078982
Blocks: 2005130
TreeView+ depends on / blocked
 
Reported: 2021-09-16 20:17 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-05-17 09:41 UTC (History)
53 users (show)

Fixed In Version: httpd 2.4.49
Doc Type: If docs needed, set a value
Doc Text:
A Server-Side Request Forgery (SSRF) flaw was found in mod_proxy of httpd. This flaw allows a remote, unauthenticated attacker to make the httpd server forward requests to an arbitrary server. The attacker could get, modify, or delete resources on other services that may be behind a firewall and inaccessible otherwise. The impact of this flaw varies based on what services and resources are available on the httpd network.
Clone Of:
Environment:
Last Closed: 2021-10-07 14:08:16 UTC
Embargoed:

Attachments (Terms of Use)
Apache HTTP Server mod_proxy 模块 SSRF漏洞 (768.27 KB, application/x-executable)
2022-02-08 08:43 UTC, FTH 		no flags Details
Apache HTTP Server mod_proxy 模块 SSRF漏洞 (768.27 KB, application/x-executable)
2022-02-08 08:55 UTC, FTH 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:3792 0 None None None 2021-10-12 12:44:01 UTC
Red Hat Product Errata RHBA-2021:3869 0 None None None 2021-10-14 17:13:48 UTC
Red Hat Product Errata RHBA-2021:3875 0 None None None 2021-10-14 23:23:05 UTC
Red Hat Product Errata RHBA-2021:3920 0 None None None 2021-10-19 15:51:57 UTC
Red Hat Product Errata RHSA-2021:3745 0 None None None 2021-10-07 13:35:45 UTC
Red Hat Product Errata RHSA-2021:3746 0 None None None 2021-10-07 13:45:27 UTC
Red Hat Product Errata RHSA-2021:3754 0 None None None 2021-10-11 08:03:56 UTC
Red Hat Product Errata RHSA-2021:3816 0 None None None 2021-10-12 16:17:07 UTC
Red Hat Product Errata RHSA-2021:3836 0 None None None 2021-10-13 07:24:47 UTC
Red Hat Product Errata RHSA-2021:3837 0 None None None 2021-10-13 07:21:23 UTC
Red Hat Product Errata RHSA-2021:3856 0 None None None 2021-10-14 08:58:23 UTC

Description Guilherme de Almeida Suckevicz 2021-09-16 20:17:59 UTC 
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Reference:
https://httpd.apache.org/security/vulnerabilities_24.html
Comment 1 Guilherme de Almeida Suckevicz 2021-09-16 20:18:22 UTC 
Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 2005118]
Comment 3 Ted Jongseok Won 2021-09-17 04:01:01 UTC 
This vulnerability is out of security support scope for the following product:
 * Red Hat JBoss Enterprise Application Platform 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Comment 5 Riccardo Schirone 2021-09-23 11:37:49 UTC 
As this issue seems about Unix sockets (UDS), it does not affect the versions of httpd shipped in RHEL 6 and 7 because support for unix: in mod_proxy was added only in upstream versions 2.4.7 and later. RHEL 6 and RHEL 7 ship older versions which do not include the UDS feature.
Comment 10 Riccardo Schirone 2021-10-01 15:19:54 UTC 
An attacker can use this flaw to perform all kind of HTTP methods, like GET, POST, DELETE, etc.
Comment 11 Riccardo Schirone 2021-10-01 15:20:18 UTC 
Scope set to Changed (S:C) because this flaw allows to perform requests on other services as if they would come from the httpd server, thus the real impact is to the data and services available elsewhere and not on the httpd server itself.

Attack Complexity set to High (AC:H) because an attacker would need to first perform target-specific reconnaissance in order to find out the available services and their endpoints.
Comment 12 Riccardo Schirone 2021-10-01 15:23:45 UTC 
Upstream patch:
https://svn.apache.org/viewvc?view=revision&revision=1893101
Comment 18 Riccardo Schirone 2021-10-07 08:39:51 UTC 
In reply to comment #5:
> As this issue seems about Unix sockets (UDS), it does not affect the
> versions of httpd shipped in RHEL 6 and 7 because support for unix: in
> mod_proxy was added only in upstream versions 2.4.7 and later. RHEL 6 and
> RHEL 7 ship older versions which do not include the UDS feature.

Correction on this: RHEL7 got a backport for the Unix Domain Sockets feature in mod_proxy, thus making it vulnerable to this flaw.
Comment 20 errata-xmlrpc 2021-10-07 13:35:43 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2021:3745 https://access.redhat.com/errata/RHSA-2021:3745
Comment 21 errata-xmlrpc 2021-10-07 13:45:24 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2021:3746 https://access.redhat.com/errata/RHSA-2021:3746
Comment 22 Product Security DevOps Team 2021-10-07 14:08:16 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-40438
Comment 23 errata-xmlrpc 2021-10-11 08:03:53 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2021:3754 https://access.redhat.com/errata/RHSA-2021:3754
Comment 24 Jean-Baptiste Dancre 2021-10-12 14:25:42 UTC 
(In reply to Product Security DevOps Team from comment #22)
> This bug is now closed. Further updates for individual products will be
> reflected on the CVE page(s):
> 
> https://access.redhat.com/security/cve/cve-2021-40438

Why is it closed if it is not (yet) fixed on RHEL7 nor RHEL8 ?
Comment 25 errata-xmlrpc 2021-10-12 16:17:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3816 https://access.redhat.com/errata/RHSA-2021:3816
Comment 26 errata-xmlrpc 2021-10-13 07:21:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:3837 https://access.redhat.com/errata/RHSA-2021:3837
Comment 27 errata-xmlrpc 2021-10-13 07:24:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3836 https://access.redhat.com/errata/RHSA-2021:3836
Comment 28 errata-xmlrpc 2021-10-14 08:58:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.6 Advanced Update Support
  Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.6 Telco Extended Update Support
  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 7.7 Advanced Update Support
  Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.7 Telco Extended Update Support
  Red Hat Enterprise Linux 7.2 Advanced Update Support

Via RHSA-2021:3856 https://access.redhat.com/errata/RHSA-2021:3856
Comment 32 FTH 2022-02-08 08:43:08 UTC 
Created attachment 1859720 [details]
Apache HTTP Server mod_proxy 模块 SSRF漏洞
Comment 33 FTH 2022-02-08 08:55:47 UTC 
Created attachment 1859722 [details]
Apache HTTP Server mod_proxy 模块 SSRF漏洞
Note You need to log in before you can comment on or make changes to this bug.