Auth bypass in Apache HTTP Server
CVE-2014-8109
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.220 (97.6th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.220 · newest: 0.220 · change: 0.000
Affected products
- Apache HTTP Server — versions 2.4.1, 2.4.2, 2.4.3
- Oracle Enterprise Manager Ops Center — versions 12.2.0, 12.2.1, 12.3.0
- Canonical Ubuntu Linux — versions 10.04, 12.04, 14.04
- Fedoraproject Fedora — versions 21
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcb (Patch, Third Party Advisory)
- bugzilla.redhat.com/show_bug.cgi (Patch, Third Party Advisory, Issue Tracking)
- www.ubuntu.com/usn/USN-2523-1 (vendor-advisory, Third Party Advisory)
- www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html (Third Party Advisory)
- www.openwall.com/lists/oss-security/2014/11/28/5 (mailing-list, Mailing List, Third Party Advisory)
- www.securityfocus.com/bid/73040 (VDB Entry, Third Party Advisory, vdb-entry)
- lists.apple.com/archives/security-announce/2015/Aug/msg00001.html (vendor-advisory, Mailing List, Broken Link)
- advisories.mageia.org/MGASA-2015-0011.html (Third Party Advisory)
- issues.apache.org/bugzilla/show_bug.cgi (Issue Tracking, Vendor Advisory)
- support.apple.com/kb/HT205031 (Third Party Advisory)
Frequently asked questions
- What is CVE-2014-8109?
- CVE-2014-8109 is a vulnerability in Apache HTTP Server, classified under Incorrect Authorization. Published 2014-12-29.
- Is CVE-2014-8109 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.