Actively exploited · Published Sep 16, 2021 · Assigned by apache
CVE-2021-40438mod_proxy SSRF
Critical 9.0 Exploited Ransomware
In plain English
A critical-severity server-side request forgery in Apache HTTP Server from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on December 1, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)100.0%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Dec 1, 2021
Attack tooling2Nuclei, Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Dec 15, 2021.
Official description
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | httpd | 2.4.37-43.module_el8.5.0+2597+c4b14997.alma | ALSA-2021:4537 |
| AlmaLinux:8 | httpd-devel | 2.4.37-43.module_el8.5.0+2597+c4b14997.alma | ALSA-2021:4537 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-43.module_el8.5.0+2597+c4b14997.alma | ALSA-2021:4537 |
| AlmaLinux:8 | httpd-manual | 2.4.37-43.module_el8.5.0+2597+c4b14997.alma | ALSA-2021:4537 |
| AlmaLinux:8 | httpd-tools | 2.4.37-43.module_el8.5.0+2597+c4b14997.alma | ALSA-2021:4537 |
| AlmaLinux:8 | mod_http2 | 1.15.7-3.module_el8.5.0+2609+b30d9eec | ALBA-2021:4604 |
| AlmaLinux:8 | mod_http2 | 1.15.7-3.module_el8.5.0+2609+b30d9eec | ALSA-2021:3816 |
| AlmaLinux:8 | mod_http2 | 1.15.7-3.module_el8.5.0+2609+b30d9eec | ALSA-2021:4537 |
| AlmaLinux:8 | mod_ldap | 2.4.37-43.module_el8.5.0+2597+c4b14997.alma | ALSA-2021:4537 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALBA-2021:4604 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.5.0+2609+b30d9eec | ALBA-2021:4604 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.5.0+2609+b30d9eec | ALSA-2021:3816 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.5.0+2609+b30d9eec | ALSA-2021:4537 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2021:3816 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2021:4537 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-43.module_el8.5.0+2597+c4b14997.alma | ALSA-2021:4537 |
| AlmaLinux:8 | mod_session | 2.4.37-43.module_el8.5.0+2597+c4b14997.alma | ALSA-2021:4537 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-43.module_el8.5.0+2597+c4b14997.alma | ALSA-2021:4537 |
| Alpine:v3.20 | apache2 | 2.4.49-r0 | ALPINE-CVE-2021-40438 |
| Alpine:v3.21 | apache2 | 2.4.49-r0 | ALPINE-CVE-2021-40438 |
| Alpine:v3.22 | apache2 | 2.4.49-r0 | ALPINE-CVE-2021-40438 |
| Alpine:v3.23 | apache2 | 2.4.49-r0 | ALPINE-CVE-2021-40438 |
| Alpine:v3.24 | apache2 | 2.4.49-r0 | ALPINE-CVE-2021-40438 |
| Debian:12 | apache2 | 2.4.49-1 | DEBIAN-CVE-2021-40438 |
| Debian:13 | apache2 | 2.4.49-1 | DEBIAN-CVE-2021-40438 |
| Debian:14 | apache2 | 2.4.49-1 | DEBIAN-CVE-2021-40438 |
| Rocky Linux:8 | httpd | 0:2.4.37-39.module+el8.4.0+571+fd70afb1 | RLSA-2021:3816 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-3.module+el8.5.0+695+1fa8055e | RLSA-2021:3816 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-3.module+el8.4.0+553+7a69454b | RLSA-2021:3816 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.4.0+553+7a69454b | RLSA-2021:3816 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e | RLSA-2021:3816 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | Apache HTTP Server 2.4 – through 2.4.48 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://httpd.apache.org/security/vulnerabilities_24.html x_refsource_MISC
- FEDORA-2021-dce7e7738e vendor-advisory, x_refsource_FEDORA
- [httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info mailing-list, x_refsource_MLIST
- [httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info mailing-list, x_refsource_MLIST
- [httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info mailing-list, x_refsource_MLIST
- [httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info mailing-list, x_refsource_MLIST
- FEDORA-2021-e3f6dd670d vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update mailing-list, x_refsource_MLIST
- [httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression mailing-list, x_refsource_MLIST
- DSA-4982 vendor-advisory, x_refsource_DEBIAN
- [httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438 mailing-list, x_refsource_MLIST
- [httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438 mailing-list, x_refsource_MLIST
- 20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021 vendor-advisory, x_refsource_CISCO
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://www.tenable.com/security/tns-2021-17 x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20211008-0004/ x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf x_refsource_CONFIRM
- GLSA-202208-20 vendor-advisory, x_refsource_GENTOO
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438 government-resource