SSRF in Apache Http_server
CVE-2021-40438
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 1.000 (100.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Apache Http_server
- Apache Software Foundation Http Server — versions Apache HTTP Server 2.4
- Broadcom Brocade_fabric_operating_system_firmware
- F5 F5os
- Netapp Cloud_backup
- Netapp Clustered_data_ontap
- Netapp Storagegrid
- Oracle Enterprise_manager_ops_center — versions 12.4.0.0
- Oracle Http_server — versions 12.2.1.3.0, 12.2.1.4.0
- Oracle Instantis_enterprisetrack — versions 17.1, 17.2, 17.3
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
- sixpacksecurity/CVE-2021-40438
- sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit
- xiaojiangxl/CVE-2021-40438
- BabyTeam1024/CVE-2021-40438
- Cappricio-Securities/CVE-2021-40438
- gassara-kys/CVE-2021-40438
- pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt
- n0m-d/CVE-2021-40438-POC
- yakir2b/check-point-gateways-rce
- ericmann/apache-cve-poc
References
- security@apache.org (x_refsource_MISC, Release Notes, Vendor Advisory)
- security@apache.org (x_refsource_FEDORA, vendor-advisory, Release Notes)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List)
- security@apache.org (x_refsource_FEDORA, vendor-advisory, Release Notes)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List)
- security@apache.org (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2021-40438?
- CVE-2021-40438 is a critical-severity vulnerability in Apache Http_server, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.0/10. Published 2021-09-16.
- How severe is CVE-2021-40438?
- Critical severity. CVSS v3 base score is 9.0 out of 10.
- Is CVE-2021-40438 known to be exploited?
- Yes. CVE-2021-40438 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-12-01), indicating it is being actively exploited. 73 public proof-of-concept repositories are indexed.