Experience the impact of the Path Traversal Vulnerability to blame for the recent Apache woes
At the beginning of October, Apache released version 2.4.49 to fix a Path Traversal and Remote Code Execution vulnerability and then subsequently 2.4.50 to address the fact that the fix in 2.4.49 was incomplete. Perhaps you’ve seen talk on social media about the importance of updating to the latest version to avoid these risks, given that Apache powers 25% of the internet by some estimates. But what’s the deal? How much risk exists here?
Why not try it out yourself?
We’ve built a mission to demonstrate the risks in a real-life environment and have made it public for everyone to try. In this Mission, we’ll walk you through how the Path Traversal Vulnerability can impact your infrastructure and applications. Click below to jump right in, or continue reading to learn more about the vulnerability in detail.
About the Path Traversal Vulnerability
The vulnerability was introduced in the 2.4.49 release (due to a change to the URL normalization function), where a new path normalization function was introduced. Unfortunately, it failed to correctly normalize URL encoded paths. This makes it possible to conduct a path traversal attack if the following configuration is not present:
.png)
And if mod_cgi is enabled, it can also be leveraged into a Remote Code Execution vulnerability. But let’s first dig into URL encoding to better understand what went wrong.
URL Encoding
At its most basic, the vulnerability occurs due to a lack of consideration for URLs with URL encoding. The newly introduced path normalization function did not fully handle cases where dots were URL encoded.
Remember that to conduct a path traversal attack, you will need to traverse with the sequence ../. The normalization function, however, is smart enough to strip that out. So what do you do? You can URL encode a .(Dot) down to %2e, and use a sequence like .%2e/. That would work in many cases against Apache 2.4.40. But you can also go one step further and double encode it. The URL encoded version of .%2e/ is .%252e/. This was further able to bypass the attempted normalization by Apache.
But there's a catch
If someone wanted to try to exploit this vulnerability straight in their browser, they would not be successful. This is due to the fact that browsers also try to normalize URLs that are sent to servers. This means that even our double-encoded sequence will be removed. It also means that we can't simply use a browser to demonstrate this.
You can use cURL to demonstrate this by using the --path-as-is flag, which prevents it from normalizing the URL before sending it:
.png)
Prevention and mitigation
To fully prevent the issue, it's important to keep up to date with the latest patches from Apache. Specifically, you will want to upgrade to 2.4.51 at a minimum. But it's a good practice to upgrade on a regular schedule to stay up to date.
To mitigate against this issue if you are running 2.4.49, ensure that you have included the following in your Apache configuration:
.png)
And to prevent Remote Code Execution, disable mod_cgi if you do not utilize it.
Experience the impact for yourself
Interested in exploring exactly what happened and trying it out for yourself?
At the beginning of October, Apache released version 2.4.49 to fix a Path Traversal and Remote Code Execution vulnerability and then 2.4.50 to address the fact that the fix was incomplete. We’ve built a mission to demonstrate the risks in a real-life environment. Try it out now.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demo
At the beginning of October, Apache released version 2.4.49 to fix a Path Traversal and Remote Code Execution vulnerability and then subsequently 2.4.50 to address the fact that the fix in 2.4.49 was incomplete. Perhaps you’ve seen talk on social media about the importance of updating to the latest version to avoid these risks, given that Apache powers 25% of the internet by some estimates. But what’s the deal? How much risk exists here?
Why not try it out yourself?
We’ve built a mission to demonstrate the risks in a real-life environment and have made it public for everyone to try. In this Mission, we’ll walk you through how the Path Traversal Vulnerability can impact your infrastructure and applications. Click below to jump right in, or continue reading to learn more about the vulnerability in detail.
About the Path Traversal Vulnerability
The vulnerability was introduced in the 2.4.49 release (due to a change to the URL normalization function), where a new path normalization function was introduced. Unfortunately, it failed to correctly normalize URL encoded paths. This makes it possible to conduct a path traversal attack if the following configuration is not present:
And if mod_cgi is enabled, it can also be leveraged into a Remote Code Execution vulnerability. But let’s first dig into URL encoding to better understand what went wrong.
URL Encoding
At its most basic, the vulnerability occurs due to a lack of consideration for URLs with URL encoding. The newly introduced path normalization function did not fully handle cases where dots were URL encoded.
Remember that to conduct a path traversal attack, you will need to traverse with the sequence ../. The normalization function, however, is smart enough to strip that out. So what do you do? You can URL encode a .(Dot) down to %2e, and use a sequence like .%2e/. That would work in many cases against Apache 2.4.40. But you can also go one step further and double encode it. The URL encoded version of .%2e/ is .%252e/. This was further able to bypass the attempted normalization by Apache.
But there's a catch
If someone wanted to try to exploit this vulnerability straight in their browser, they would not be successful. This is due to the fact that browsers also try to normalize URLs that are sent to servers. This means that even our double-encoded sequence will be removed. It also means that we can't simply use a browser to demonstrate this.
You can use cURL to demonstrate this by using the --path-as-is flag, which prevents it from normalizing the URL before sending it:
Prevention and mitigation
To fully prevent the issue, it's important to keep up to date with the latest patches from Apache. Specifically, you will want to upgrade to 2.4.51 at a minimum. But it's a good practice to upgrade on a regular schedule to stay up to date.
To mitigate against this issue if you are running 2.4.49, ensure that you have included the following in your Apache configuration:
And to prevent Remote Code Execution, disable mod_cgi if you do not utilize it.
Experience the impact for yourself
Interested in exploring exactly what happened and trying it out for yourself?
At the beginning of October, Apache released version 2.4.49 to fix a Path Traversal and Remote Code Execution vulnerability and then subsequently 2.4.50 to address the fact that the fix in 2.4.49 was incomplete. Perhaps you’ve seen talk on social media about the importance of updating to the latest version to avoid these risks, given that Apache powers 25% of the internet by some estimates. But what’s the deal? How much risk exists here?
Why not try it out yourself?
We’ve built a mission to demonstrate the risks in a real-life environment and have made it public for everyone to try. In this Mission, we’ll walk you through how the Path Traversal Vulnerability can impact your infrastructure and applications. Click below to jump right in, or continue reading to learn more about the vulnerability in detail.
About the Path Traversal Vulnerability
The vulnerability was introduced in the 2.4.49 release (due to a change to the URL normalization function), where a new path normalization function was introduced. Unfortunately, it failed to correctly normalize URL encoded paths. This makes it possible to conduct a path traversal attack if the following configuration is not present:
And if mod_cgi is enabled, it can also be leveraged into a Remote Code Execution vulnerability. But let’s first dig into URL encoding to better understand what went wrong.
URL Encoding
At its most basic, the vulnerability occurs due to a lack of consideration for URLs with URL encoding. The newly introduced path normalization function did not fully handle cases where dots were URL encoded.
Remember that to conduct a path traversal attack, you will need to traverse with the sequence ../. The normalization function, however, is smart enough to strip that out. So what do you do? You can URL encode a .(Dot) down to %2e, and use a sequence like .%2e/. That would work in many cases against Apache 2.4.40. But you can also go one step further and double encode it. The URL encoded version of .%2e/ is .%252e/. This was further able to bypass the attempted normalization by Apache.
But there's a catch
If someone wanted to try to exploit this vulnerability straight in their browser, they would not be successful. This is due to the fact that browsers also try to normalize URLs that are sent to servers. This means that even our double-encoded sequence will be removed. It also means that we can't simply use a browser to demonstrate this.
You can use cURL to demonstrate this by using the --path-as-is flag, which prevents it from normalizing the URL before sending it:
Prevention and mitigation
To fully prevent the issue, it's important to keep up to date with the latest patches from Apache. Specifically, you will want to upgrade to 2.4.51 at a minimum. But it's a good practice to upgrade on a regular schedule to stay up to date.
To mitigate against this issue if you are running 2.4.49, ensure that you have included the following in your Apache configuration:
And to prevent Remote Code Execution, disable mod_cgi if you do not utilize it.
Experience the impact for yourself
Interested in exploring exactly what happened and trying it out for yourself?
Click on the link below and download the PDF of this resource.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demo
At the beginning of October, Apache released version 2.4.49 to fix a Path Traversal and Remote Code Execution vulnerability and then subsequently 2.4.50 to address the fact that the fix in 2.4.49 was incomplete. Perhaps you’ve seen talk on social media about the importance of updating to the latest version to avoid these risks, given that Apache powers 25% of the internet by some estimates. But what’s the deal? How much risk exists here?
Why not try it out yourself?
We’ve built a mission to demonstrate the risks in a real-life environment and have made it public for everyone to try. In this Mission, we’ll walk you through how the Path Traversal Vulnerability can impact your infrastructure and applications. Click below to jump right in, or continue reading to learn more about the vulnerability in detail.
About the Path Traversal Vulnerability
The vulnerability was introduced in the 2.4.49 release (due to a change to the URL normalization function), where a new path normalization function was introduced. Unfortunately, it failed to correctly normalize URL encoded paths. This makes it possible to conduct a path traversal attack if the following configuration is not present:
And if mod_cgi is enabled, it can also be leveraged into a Remote Code Execution vulnerability. But let’s first dig into URL encoding to better understand what went wrong.
URL Encoding
At its most basic, the vulnerability occurs due to a lack of consideration for URLs with URL encoding. The newly introduced path normalization function did not fully handle cases where dots were URL encoded.
Remember that to conduct a path traversal attack, you will need to traverse with the sequence ../. The normalization function, however, is smart enough to strip that out. So what do you do? You can URL encode a .(Dot) down to %2e, and use a sequence like .%2e/. That would work in many cases against Apache 2.4.40. But you can also go one step further and double encode it. The URL encoded version of .%2e/ is .%252e/. This was further able to bypass the attempted normalization by Apache.
But there's a catch
If someone wanted to try to exploit this vulnerability straight in their browser, they would not be successful. This is due to the fact that browsers also try to normalize URLs that are sent to servers. This means that even our double-encoded sequence will be removed. It also means that we can't simply use a browser to demonstrate this.
You can use cURL to demonstrate this by using the --path-as-is flag, which prevents it from normalizing the URL before sending it:
Prevention and mitigation
To fully prevent the issue, it's important to keep up to date with the latest patches from Apache. Specifically, you will want to upgrade to 2.4.51 at a minimum. But it's a good practice to upgrade on a regular schedule to stay up to date.
To mitigate against this issue if you are running 2.4.49, ensure that you have included the following in your Apache configuration:
And to prevent Remote Code Execution, disable mod_cgi if you do not utilize it.
Experience the impact for yourself
Interested in exploring exactly what happened and trying it out for yourself?
Table of contents
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise
The Secure-by-Design movement is the future of secure software development. Learn about the key elements companies need to keep in mind when they think about a Secure-by-Design initiative.
DigitalOcean Decreases Security Debt with Secure Code Warrior
DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.
Resources to get you started
Trust Score Reveals the Value of Secure-by-Design Upskilling Initiatives
Our research has shown that secure code training works. Trust Score, using an algorithm drawing on more than 20 million learning data points from work by more than 250,000 learners at over 600 organizations, reveals its effectiveness in driving down vulnerabilities and how to make the initiative even more effective.
.png)
Reactive Versus Preventive Security: Prevention Is a Better Cure
The idea of bringing preventive security to legacy code and systems at the same time as newer applications can seem daunting, but a Secure-by-Design approach, enforced by upskilling developers, can apply security best practices to those systems. It’s the best chance many organizations have of improving their security postures.
The Benefits of Benchmarking Security Skills for Developers
The growing focus on secure code and Secure-by-Design principles requires developers to be trained in cybersecurity from the start of the SDLC, with tools like Secure Code Warrior’s Trust Score helping measure and improve their progress.
Driving Meaningful Success for Enterprise Secure-by-Design Initiatives
Our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.
Developer-driven coding.
Securely.
Contact us today and make software security an intrinsic part of your development process.
