Apache--=-2.4.48-Mod_Proxy-SSRF-(CVE-2021-40438).json

{
  "Name": "Apache <= 2.4.48 Mod_Proxy SSRF (CVE-2021-40438)",
  "Description": "<p>Apache HTTP Server is an open source web server of the Apache Foundation.</p><p>SSRF vulnerability exists in Apache HTTP Server 2.4.48 and earlier versions,a crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.</p>",
  "Product": "Apache",
  "Homepage": "http://httpd.apache.org/",
  "DisclosureDate": "2021-10-15",
  "Author": "keeeee",
  "FofaQuery": "server=\"Apache\" || app=\"APACHE-Web-Server\"",
  "GobyQuery": "server=\"Apache\" || app=\"APACHE-Web-Server\"",
  "Level": "3",
  "Impact": "<p>SSRF vulnerability exists in Apache HTTP Server 2.4.48 and earlier versions,Attackers can use this vulnerability to scan the external network, the internal network where the server is located, and the local port scan, and attack applications running on the internal network or local, etc.</p>",
  "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://httpd.apache.org/security/vulnerabilities_24.html\" target=\"_blank\">https://httpd.apache.org/security/vulnerabilities_24.html</a><br></p>",
  "References": [
    "https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-40438.yaml",
    "https://nvd.nist.gov/vuln/detail/CVE-2021-40438"
  ],
  "Translation": {
	"CN": {
      "Name": "Apache 小于 2.4.48版本 Mod_Proxy SSRF漏洞（CVE-2021-40438）",
	  "Product": "Apache",
      "VulType": ["SSRF漏洞"],
	  "Tags": ["SSRF漏洞"],
      "Description": "<p>Apache HTTP Server 是阿帕奇（Apache）基金会的一款开源网页服务器。</p><p>Apache HTTP Server 2.4.48 及更早版本存在 SSRF 漏洞，攻击者可以发送精心设计的请求 uri-path 导致 mod_proxy 将请求转发到远程用户选择的源服务器。<br></p>",
      "Impact": "<p>Apache HTTP Server 2.4.48 及更早版本存在 SSRF 漏洞，攻击者可以发送精心设计的请求 uri-path 导致 mod_proxy 将请求转发到远程用户选择的源服务器。</p>",
      "Recommendation": "<p>厂商已发布了漏洞修复程序，请及时关注更新：&nbsp;<a href=\"https://httpd.apache.org/security/vulnerabilities_24.html\" target=\"_blank\">https://httpd.apache.org/security/vulnerabilities_24.html</a><br></p>"
    },
    "EN": {
      "Name": "Apache <= 2.4.48 Mod_Proxy SSRF (CVE-2021-40438)",
      "Product": "Apache",
      "VulType": [
        "ssrf"
      ],
      "Tags": [
        "ssrf"
      ],
      "Description": "<p>Apache HTTP Server is an open source web server of the Apache Foundation.</p><p>SSRF vulnerability exists in Apache HTTP Server 2.4.48 and earlier versions,a crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.</p>",
      "Impact": "<p>SSRF vulnerability exists in Apache HTTP Server 2.4.48 and earlier versions,Attackers can use this vulnerability to scan the external network, the internal network where the server is located, and the local port scan, and attack applications running on the internal network or local, etc.</p>",
      "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://httpd.apache.org/security/vulnerabilities_24.html\">https://httpd.apache.org/security/vulnerabilities_24.html</a></p><p>1. Set access policies and whitelist access through security devices such as firewalls.</p><p>2.Upgrade the Apache system version.</p>"
    }
  },
  "Is0day": false,
  "HasExp": true,
  "ExpParams": [
    {
      "name": "ssrf",
      "type": "input",
      "value": "http://www.baidu.com"
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "method": "GET",
        "uri": "/test.php",
        "follow_redirect": true,
        "header": {},
        "data_type": "text",
        "data": ""
      },
      "ResponseTest": {
        "type": "group",
        "operation": "AND",
        "checks": [
          {
            "type": "item",
            "variable": "$code",
            "operation": "==",
            "value": "200",
            "bz": ""
          },
          {
            "type": "item",
            "variable": "$body",
            "operation": "contains",
            "value": "test",
            "bz": ""
          }
        ]
      },
      "SetVariable": []
    }
  ],
  "ExploitSteps": [
    "AND",
    {
      "Request": {
        "method": "GET",
        "uri": "/test.php",
        "follow_redirect": true,
        "header": {},
        "data_type": "text",
        "data": ""
      },
      "ResponseTest": {
        "type": "group",
        "operation": "AND",
        "checks": [
          {
            "type": "item",
            "variable": "$code",
            "operation": "==",
            "value": "200",
            "bz": ""
          },
          {
            "type": "item",
            "variable": "$body",
            "operation": "contains",
            "value": "test",
            "bz": ""
          }
        ]
      },
      "SetVariable": []
    }
  ],
  "Tags": [
    "ssrf"
  ],
  "VulType": [
    "ssrf"
  ],
  "CVEIDs": [
    "CVE-2021-40438"
  ],
  "CNNVD": [
    ""
  ],
  "CNVD": [
    ""
  ],
  "CVSSScore": "9.0",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}