CVE-2021-40438·Apache vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 100% — among the highest-scoring CVEs ever published. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.49-1 or later to patch the mod_proxy request routing vulnerability. This critical flaw allows attackers to manipulate URI paths and redirect traffic to arbitrary origin servers under their control. Organizations using Apache 2.4.48 or earlier with mod_proxy enabled should prioritize this update immediately, as active exploitation has been documented.

sudo dnf update httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET|POST|CONNECT .*(\.\.%2f|\.\.%5c|://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|ProxyPassReverse|X-Forwarded-Host:.*[0-9]{1,3}\.[0-9]{1,3}) HTTP

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Configure ModSecurity or other WAF to block requests containing path traversal sequences (../ or encoded variants) and requests with X-Forwarded-Host headers pointing to RFC1918 or non-whitelisted external IP ranges. Implement strict validation on URI paths before they reach mod_proxy handlers. Additionally, restrict ProxyPass directives to explicitly defined destination hosts only and reject any dynamic host resolution.

How to check if you are affected

1. Step 1: Check your Apache version by running: apache2ctl -v or httpd -v — confirm if version is 2.4.48 or earlier
2. Step 2: Verify mod_proxy is loaded by running: apache2ctl -M | grep proxy or httpd -M | grep proxy — if output shows 'proxy_module' or 'proxy_http_module', the attack surface is active
3. Step 3: Review Apache access logs for suspicious URI patterns containing encoded or double-encoded path segments targeting external IPs: grep -E '\.\.%|%2e%2e|://[0-9]{1,3}\.[0-9]{1,3}' /var/log/apache2/access.log*
4. Step 4: Verify the patch by running: apache2ctl -v or httpd -v again after upgrading and confirm version is 2.4.49-1 or higher

FAQ

Related Apache CVEs

References

• https://security-tracker.debian.org/tracker/CVE-2021-40438