CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF)
Attackers can force Apache mod_proxy to forward requests to arbitrary internal servers, enabling access to restricted resources.
- Exploited in the wild
- Since 1 Dec 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-40438?
CVE-2021-40438 is a critical server-side request forgery vulnerability in Apache Http Server, published on 16 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Weakness: CWE-918
Which versions are affected by CVE-2021-40438?
1 open source package ship an affected version, including apache. It affects 39 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | All versions | 2.4.49 |
Linux distribution packages (39)
mod_http2 AlmaLinux:8 | All versions | 1.15.7-3.module_el8.5.0+2609+b30d9eec |
mod_md AlmaLinux:8 | All versions | 1:2.0.8-8.module_el8.5.0+2609+b30d9eec |
mod_md AlmaLinux:8 | All versions | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa |
httpd Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-97.el7_9.1 |
httpd-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-97.el7_9.1 |
httpd-devel Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-97.el7_9.1 |
httpd-manual Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-97.el7_9.1 |
httpd-tools Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-97.el7_9.1 |
mod_ldap Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-97.el7_9.1 |
mod_proxy_html Red Hat:enterprise_linux:7::client | All versions | 1:2.4.6-97.el7_9.1 |
mod_session Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-97.el7_9.1 |
mod_ssl Red Hat:enterprise_linux:7::client | All versions | 1:2.4.6-97.el7_9.1 |
httpd Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-97.el7_9.1 |
httpd-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-97.el7_9.1 |
httpd-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-97.el7_9.1 |
httpd-manual Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-97.el7_9.1 |
httpd-tools Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-97.el7_9.1 |
mod_ldap Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-97.el7_9.1 |
mod_proxy_html Red Hat:enterprise_linux:7::computenode | All versions | 1:2.4.6-97.el7_9.1 |
mod_session Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-97.el7_9.1 |
mod_ssl Red Hat:enterprise_linux:7::computenode | All versions | 1:2.4.6-97.el7_9.1 |
httpd Red Hat:enterprise_linux:7::server | All versions | 0:2.4.6-97.el7_9.1 |
httpd-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:2.4.6-97.el7_9.1 |
httpd-devel Red Hat:enterprise_linux:7::server | All versions | 0:2.4.6-97.el7_9.1 |
httpd-manual Red Hat:enterprise_linux:7::server | All versions | 0:2.4.6-97.el7_9.1 |
httpd-tools Red Hat:enterprise_linux:7::server | All versions | 0:2.4.6-97.el7_9.1 |
mod_ldap Red Hat:enterprise_linux:7::server | All versions | 0:2.4.6-97.el7_9.1 |
mod_proxy_html Red Hat:enterprise_linux:7::server | All versions | 1:2.4.6-97.el7_9.1 |
mod_session Red Hat:enterprise_linux:7::server | All versions | 0:2.4.6-97.el7_9.1 |
mod_ssl Red Hat:enterprise_linux:7::server | All versions | 1:2.4.6-97.el7_9.1 |
httpd Red Hat:enterprise_linux:7::workstation | All versions | 0:2.4.6-97.el7_9.1 |
httpd-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:2.4.6-97.el7_9.1 |
httpd-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:2.4.6-97.el7_9.1 |
httpd-manual Red Hat:enterprise_linux:7::workstation | All versions | 0:2.4.6-97.el7_9.1 |
httpd-tools Red Hat:enterprise_linux:7::workstation | All versions | 0:2.4.6-97.el7_9.1 |
mod_ldap Red Hat:enterprise_linux:7::workstation | All versions | 0:2.4.6-97.el7_9.1 |
mod_proxy_html Red Hat:enterprise_linux:7::workstation | All versions | 1:2.4.6-97.el7_9.1 |
mod_session Red Hat:enterprise_linux:7::workstation | All versions | 0:2.4.6-97.el7_9.1 |
mod_ssl Red Hat:enterprise_linux:7::workstation | All versions | 1:2.4.6-97.el7_9.1 |
Products include Apache Http Server, Broadcom Brocade Fabric Operating System Firmware, Debian Debian Linux, F5 F5os, Fedoraproject Fedora, Netapp Cloud Backup and 33 more.
How do I fix CVE-2021-40438?
Upgrade apache to 2.4.49 or later. US federal agencies must fix it by 15 Dec 2021.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-40438 being exploited?
Yes. Attackers have exploited CVE-2021-40438 in the wild since at least 1 Dec 2021, including in ransomware campaigns.
Public exploit code: 1 Nuclei template and 11 proofs of concept on GitHub.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALBA-2021:4604, ALPINE-CVE-2021-40438, AZL-6487, BIT-apache-2021-40438, CLEANSTART-2026-BM33422, DEBIAN-CVE-2021-40438 and 8 more.