CVE-2024-10306: Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests
A vulnerability was found in modproxycluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.
Other sources
The issue is that the <Directory> directive should be replaced by <Location> directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Apache configuration for mod_proxy_cluster so that the access control that currently uses a <Directory> block is implemented using a <Location> directive, because <Directory> does not enforce the intended IP/host restrictions (e.g., 'Require ip IP_ADDRESS' does not restrict access as expected when applied under <Directory>).
Apache httpd (mod_proxy_cluster) Replace <Directory> with <Location> for access control = Use <Location> directive with Require ip IP_ADDRESS (or equivalent) instead of <Directory> - Compensating control
Ensure this host running mod_proxy_cluster is not accessible from the public network (since it does not serve general traffic). Limit network access to trusted/internal sources only to prevent unauthorized MCMP requests that could add/remove/update balancing nodes.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10306?
CVE-2024-10306 is considered a critical vulnerability due to the risk of unauthorized access through improper IP/host access restriction.
How do I fix CVE-2024-10306?
To fix CVE-2024-10306, replace the <Directory> directive with the <Location> directive in your Apache mod_proxy_cluster configuration.
What are the potential impacts of CVE-2024-10306?
The potential impacts of CVE-2024-10306 include unauthorized users gaining access to server resources, leading to data exposure and security breaches.
Which versions of Apache mod_proxy_cluster are affected by CVE-2024-10306?
CVE-2024-10306 affects all versions of Apache mod_proxy_cluster that utilize the <Directory> directive without proper access control.
Is there a workaround for CVE-2024-10306?
A potential workaround for CVE-2024-10306 is to ensure that access controls are properly configured, although replacing the directive is the recommended solution.