At Black Hat USA 2024, a cutting-edge research presentation unveiled critical architectural flaws within the Apache HTTP Server, a prevalent web server software.
The study sheds light on numerous technical shortcomings in Httpd, revealing three distinct types of Confusion Attacks, nine newly identified vulnerabilities, 20 methods of exploitation, and over 30 illustrative case studies.
The Apache HTTP Server utilizes a modular architecture, with hundreds of individual modules collaborating to process HTTP requests. These modules share a common request_rec structure for synchronization, communication, and data handling.
As HTTP requests progress through various stages, different modules modify this structure as necessary.
While this modular approach allows each component to specialize, the complexity escalates with the integration of hundreds of modules.
Orange Tsai’s research underscores that the lack of thorough understanding among modules and the absence of rigorous development protocols create vulnerabilities and inconsistencies, making the system susceptible to exploitation.
Newly Discovered Vulnerabilities
The research has identified nine new vulnerabilities in Apache HTTP Server, including:
- CVE-2024-38472 – Apache HTTP Server on Windows UNC SSRF
- CVE-2024-39573 – Apache HTTP Server proxy encoding issue
- CVE-2024-38477 – Apache HTTP Server crash causing Denial of Service in mod_proxy via a crafted request
- CVE-2024-38476 – Apache HTTP Server could leverage malicious backend application output to run local handlers through internal redirects
- CVE-2024-38475 – Apache HTTP Server flaw in mod_rewrite when the initial segment of substitution matches a filesystem path
- CVE-2024-38474 – Apache HTTP Server vulnerability with encoded question marks in backreferences
- CVE-2024-38473 – Apache HTTP Server proxy encoding issue
- CVE-2023-38709 – Apache HTTP Server HTTP response splitting
- CVE-2024-?????? – Yet-to-be-fixed vulnerability
Confusion Attacks
Confusion Attacks are a novel threat vector exploiting the internal mechanisms and design of the Apache HTTP Server.
Three main types of Confusion Attacks were identified:
- Filename Confusion: This vulnerability arises from the inconsistent treatment of the r->filename field by different modules. Some modules interpret it as a URL, while others see it as a filesystem path, leading to potential security issues like path truncation and unauthorized access.
- DocumentRoot Confusion: This attack exploits inconsistencies in handling paths with and without the DocumentRoot prefix. It can lead to unintended file access, source code exposure, and unauthorized actions through manipulated local scripts or configurations.
- Handler Confusion: This issue stems from the interchangeable use of AddType and AddHandler directives, which can cause handlers to be overwritten or misused. Attackers might exploit this to execute arbitrary code or manipulate internal module handlers.
Implications and Recommendations
The vulnerabilities discovered pose significant risks for organizations utilizing Apache HTTP Server. To mitigate these threats, it is crucial for administrators to update their servers to the latest version (2.4.60) and carefully review their configurations to avoid potential disruptions.
This research emphasizes the necessity of understanding the intricate mechanisms and architectural design of commonly used software like Apache HTTP Server. By highlighting these vulnerabilities, it aims to help organizations enhance their security posture and protect against emerging threats.
