Apache HTTP Server 2.4.49路径遍历漏洞

详细信息

漏洞类型

路径遍历

漏洞描述

在Apache HTTP服务器2.4.49中对路径规范化所做的更改中发现了一个缺陷。攻击者可以使用路径遍历攻击将URL映射到预期文档根以外的文件。 如果文档根目录以外的文件不受require all denied保护，则这些请求可能会成功。此外，该漏洞可能会泄漏解释文件（如CGI脚本）的源。 此问题只影响Apache 2.4.49，而不影响早期版本。

修复建议

升级至Apache HTTP Server的最新版本（2.4.50或更高版本），可从Apache网站获得： http://httpd.apache.org/security/vulnerabilities_24.html

参考链接

• http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html

  NVD · Third Party Advisory · VDB Entry · Exploit

• http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html

  NVD · Third Party Advisory · VDB Entry · Exploit

• http://www.openwall.com/lists/oss-security/2021/10/05/2

  NVD · Mailing List · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2021/10/07/1

  NVD · Mailing List · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2021/10/07/6

  NVD · Mailing List · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2021/10/08/1

  NVD · Mailing List · Third Party Advisory · Exploit

• https://httpd.apache.org/security/vulnerabilities_24.html

  NVD · Release Notes · Vendor Advisory

• https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ

  OSV · vendor-advisory · x_refsource_CISCO

• http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html

  OSV · x_refsource_MISC

• https://security.gentoo.org/glsa/202208-20

  OSV · vendor-advisory · x_refsource_GENTOO

• http://www.openwall.com/lists/oss-security/2021/10/08/3

  OSV · mailing-list · x_refsource_MLIST

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/

  OSV · vendor-advisory · x_refsource_FEDORA

• http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html

  OSV · x_refsource_MISC

• http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html

  OSV · x_refsource_MISC

• http://www.openwall.com/lists/oss-security/2021/10/15/3

  OSV · mailing-list · x_refsource_MLIST

• http://www.openwall.com/lists/oss-security/2021/10/16/1

  OSV · mailing-list · x_refsource_MLIST

• https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E

  OSV · mailing-list · x_refsource_MLIST

• http://www.openwall.com/lists/oss-security/2021/10/07/1

  OSV · mailing-list · x_refsource_MLIST

• https://security.netapp.com/advisory/ntap-20211029-0009/

  OSV · x_refsource_CONFIRM

• https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E

  OSV · mailing-list · x_refsource_MLIST

• http://www.openwall.com/lists/oss-security/2021/10/08/4

  OSV · mailing-list · x_refsource_MLIST

• http://www.openwall.com/lists/oss-security/2021/10/07/6

  OSV · mailing-list · x_refsource_MLIST

• https://www.oracle.com/security-alerts/cpujan2022.html

  OSV · x_refsource_MISC

• http://www.openwall.com/lists/oss-security/2021/10/08/2

  OSV · mailing-list · x_refsource_MLIST

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/

  OSV · vendor-advisory · x_refsource_FEDORA

• http://www.openwall.com/lists/oss-security/2021/10/08/1

  OSV · mailing-list · x_refsource_MLIST

• http://www.openwall.com/lists/oss-security/2021/10/11/4

  OSV · mailing-list · x_refsource_MLIST

• https://httpd.apache.org/security/vulnerabilities_24.html

  OSV · x_refsource_MISC

• http://www.openwall.com/lists/oss-security/2021/10/09/1

  OSV · mailing-list · x_refsource_MLIST

• https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E

  OSV · mailing-list · x_refsource_MLIST

• http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html

  OSV · x_refsource_MISC

• http://www.openwall.com/lists/oss-security/2021/10/08/6

  OSV · mailing-list · x_refsource_MLIST

• http://www.openwall.com/lists/oss-security/2021/10/05/2

  OSV · mailing-list · x_refsource_MLIST

• http://www.openwall.com/lists/oss-security/2021/10/08/5

  OSV · mailing-list · x_refsource_MLIST

• https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E

  OSV · mailing-list · x_refsource_MLIST

• https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E

  OSV · mailing-list · x_refsource_MLIST

• https://osv.dev/vulnerability/BIT-apache-2021-41773

  OSV

• https://osv.dev/vulnerability/CVE-2021-41773

  OSV

• https://security.paloaltonetworks.com/PAN-SA-2024-0008
• https://security.alpinelinux.org/vuln/CVE-2021-41773

  OSV

• https://security-tracker.debian.org/tracker/CVE-2021-41773

  OSV

• https://nvd.nist.gov/vuln/detail/CVE-2021-41773

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2021-41773

  OSV

• https://osv.dev/vulnerability/ALPINE-CVE-2021-41773

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773

  NVD · US Government Resource