REDHAT-BUG-2374553: SSRF
SSRF in Apache HTTP Server with modproxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where modheaders is configured to modify the Content-Type request or response header with a value provided in the HTTP request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate by ensuring mod_headers is not configured to modify the Content-Type request or response header using a value provided in the incoming HTTP request.
- Compensating control
Mitigate by restricting outbound network egress or blocking access from the Apache HTTP Server host when mod_proxy is loaded, to prevent SSRF-based outbound proxy requests to attacker-controlled URLs.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires Apache HTTP Server to have mod_proxy loaded and mod_headers configured to modify a Content-Type request or response header using a value supplied in the HTTP request. The issue depends on this unlikely configuration.
What must an attacker be able to do to exploit it?
An attacker must be able to provide an HTTP request containing the value that is used by the mod_headers Content-Type modification. Successful exploitation lets the attacker cause outbound proxy requests to an attacker-controlled URL.