SSRF in Apache HTTP Server
CVE-2021-40438
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 1.000 (100.0th percentile), scored .
Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Apache HTTP Server
- Apache Software Foundation HTTP Server — versions Apache HTTP Server 2.4
- Broadcom Brocade Fabric Operating System Firmware
- F5 F5os
- NetApp Cloud Backup
- NetApp Clustered Data Ontap
- NetApp Storagegrid
- Oracle Enterprise Manager Ops Center — versions 12.4.0.0
- Oracle HTTP Server — versions 12.2.1.3.0, 12.2.1.4.0
- Oracle Instantis Enterprisetrack — versions 17.1, 17.2, 17.3
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Known ransomware campaign use: yes.
Public proof-of-concept exploits
- Kashkovsky/CVE-2021-40438
- sixpacksecurity/CVE-2021-40438
- sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit
- xiaojiangxl/CVE-2021-40438
- BabyTeam1024/CVE-2021-40438
- Cappricio-Securities/CVE-2021-40438
- gassara-kys/CVE-2021-40438
- pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt
- n0m-d/CVE-2021-40438-POC
- yakir2b/check-point-gateways-rce
References
- httpd.apache.org/security/vulnerabilities_24.html (Release Notes, Vendor Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Release Notes)
- lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5b… (mailing-list, Mailing List)
- lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7c… (mailing-list, Mailing List)
- lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb3… (mailing-list, Mailing List)
- lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54… (mailing-list, Mailing List)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Release Notes)
- lists.debian.org/debian-lts-announce/2021/10/msg00001.html (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0… (mailing-list, Mailing List)
- www.debian.org/security/2021/dsa-4982 (vendor-advisory, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-40438?
- CVE-2021-40438 is a critical-severity vulnerability in Apache HTTP Server, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.0/10. Published 2021-09-16.
- How severe is CVE-2021-40438?
- Critical severity. CVSS v3 base score is 9.0 out of 10.
- Is CVE-2021-40438 known to be exploited?
- Yes. CVE-2021-40438 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-12-01), indicating it is being actively exploited. 73 public proof-of-concept repositories are indexed.