Security News > 2021 > October > Apache web server zero-day bug is easy to exploit – patch now!
The venerable Apache web server has just been updated to fix a dangerous remote code execution bug.
This bug is already both widely-known and trivial to exploit, with examples now circulating freely on Twitter, and a single, innocent-looking web request aimed at your server could be enough for an attacker to take it over completely.
Any software product you use that has its own HTTP interface, such as a document management system or a support ticketing system, might, for all you know, be using Apache as its built-in web server.
Simply put, a path traversal bug happens when a user tries to access a file on the server that ought to be considered off-limits, but the security check on the location of the file fails.
All security conscious software, especially including web servers, needs to be on the lookout for this sort of trickery.
Initial reports correctly implied that this bug was exploitable for reading files that were off-limits, including files outside the web server's own directory tree, as well as script files inside the server tree that were not supposed to be directly accessible.
News URL
Related news
- Exploit available for new critical TeamCity auth bypass bug, patch now (source)
- Hackers Exploit Misconfigured YARN, Docker, Confluence, Redis Servers for Crypto Mining (source)
- Exploit released for Fortinet RCE bug used in attacks, patch now (source)
- Hackers exploit Ray framework flaw to breach servers, hijack resources (source)
- New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks (source)
- New HTTP/2 DoS attack can crash web servers with a single connection (source)
- Microsoft Fixes 149 Flaws in Huge April Patch Release, Zero-Days Included (source)
- Exploit released for Palo Alto PAN-OS bug used in attacks, patch now (source)
- Exploit code for Palo Alto Networks zero-day now public (source)