IP address spoofing when proxying using modremoteip and modrewrite For configurations using proxying with modremoteip and certain modrewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.
Possible CRLF injection allowing HTTP response splitting attacks for sites which use moduserdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
modauthzsvn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.
If an authorization script for LuaAuthzProvider were provided in the configuration multiple times, only the arguments of the last specification were used when invoking the script. This could lead to scripts being invoked with unexpected arguments.
Further details are available in the thread of the original report and bug:
http://www.openwall.com/lists/oss-security/2014/11/28/5
https://issues.apache.org/bugzilla/showbug.cgi?id=57204
Upstream fix:
https://github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcb
This affects Apache HTTP Server versions 2.3 and later (such as what is shipped in Red Hat Enterprise Linux 7), as modlua is not available in earlier releases. Note that support for LuaAuthzProvider is experimental.
It was reported that if Content-Type header value is empty, httpd with modcache enabled will segfault: https://issues.apache.org/bugzilla/showbug.cgi?id=56924
Upstream patch: http://svn.apache.org/viewvc?view=revision&revision=1624234
Memory leak in the winntaccept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
Race condition in the modstatus module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the statushandler function in modules/generators/modstatus.c and the luaapscoreboardworker function in modules/lua/luarequest.c.
The deflateinfilter function in moddeflate.c in the moddeflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.
The following flaw has been fixed in the Apache HTTP Server:
"A flaw was found in modcgid. If a server using modcgid hosted CGI scripts which did not consume standard input, a remote attacker could cause child processes to hang indefinitely, leading to denial of service."
External References:
http://httpd.apache.org/security/vulnerabilities24.html
Martin Holst Swende discovered a flaw in the way modheaders handled chunked requests. A remote attacker could use this flaw to bypass intended modheaders restrictions, allowing them to send requests to applications that include headers that should have been removed by modheaders.
Discussion and a possible patch is available from the following thread:
http://marc.info/?t=138219209900002&r=1&w=2
References:
http://martin.swende.se/blog/HTTPChunked.html
The davxmlgetcdata function in main/util.c in the moddav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.
The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.
moddav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the moddavsvn module, but a certain href attribute in XML data refers to a non-DAV URI.
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4558 tothe following vulnerability:
Name: CVE-2012-4558 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4558 Assigned: 20120821 Reference: http://httpd.apache.org/security/vulnerabilities22.html Reference: http://httpd.apache.org/security/vulnerabilities24.html Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/modproxybalancer.c?r1=1404653&r2=1413732&diffformat=h
Multiple cross-site scripting (XSS) vulnerabilities in the balancerhandler function in the manager interface in modproxybalancer.c in the modproxybalancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-3499 to the following vulnerability:
Name: CVE-2012-3499 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3499 Assigned: 20120614 Reference: http://httpd.apache.org/security/vulnerabilities22.html Reference: http://httpd.apache.org/security/vulnerabilities24.html Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/modinfo.c?r1=1225799&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/modstatus.c?r1=1389564&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ldap/utilldapcachemgr.c?r1=1209766&r2=1418752&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/modimagemap.c?r1=1398480&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/modproxyftp.c?r1=1404625&r2=1413732&diffformat=h
Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) modimagemap, (2) modinfo, (3) modldap, (4) modproxyftp, and (5) modstatus modules.
The proxy functionality in (1) modproxyajp.c in the modproxyajp module and (2) modproxyhttp.c in the modproxyhttp module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.
Cross-site scripting (XSS) vulnerability in the modnegotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.