Security News > 2021 > October > Apache web server zero-day bug is easy to exploit – patch now!

The venerable Apache web server has just been updated to fix a dangerous remote code execution bug.

This bug is already both widely-known and trivial to exploit, with examples now circulating freely on Twitter, and a single, innocent-looking web request aimed at your server could be enough for an attacker to take it over completely.

Any software product you use that has its own HTTP interface, such as a document management system or a support ticketing system, might, for all you know, be using Apache as its built-in web server.

Simply put, a path traversal bug happens when a user tries to access a file on the server that ought to be considered off-limits, but the security check on the location of the file fails.

All security conscious software, especially including web servers, needs to be on the lookout for this sort of trickery.

Initial reports correctly implied that this bug was exploitable for reading files that were off-limits, including files outside the web server's own directory tree, as well as script files inside the server tree that were not supposed to be directly accessible.

News URL

https://nakedsecurity.sophos.com/2021/10/06/apache-web-server-zero-day-bug-is-easy-to-exploit-patch-now/