PT-2011-4409 · Apache+2 · Apache Http Server+2

Published 2011-10-05 · Updated 2024-06-15 · CVE-2011-3368

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 1.3.x through 1.3.42 Apache HTTP Server versions 2.0.x through 2.0.64 Apache HTTP Server versions 2.2.x through 2.2.21

Description The issue arises from the mod proxy module's improper interaction with RewriteRule and ProxyPassMatch pattern matches when configuring a reverse proxy. This allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character, potentially disclosing sensitive information from internal web servers.

Recommendations For Apache HTTP Server versions 1.3.x through 1.3.42, apply the patch from https://archive.apache.org/dist/httpd/patches/apply to 1.3.42/ to resolve the issue. For Apache HTTP Server versions 2.0.x through 2.0.64, update to a version that includes the fix for this issue. For Apache HTTP Server versions 2.2.x through 2.2.21, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the RewriteRule and ProxyPassMatch directives in the mod proxy module until a patch is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-3368

DSA-2405-1

OPENSUSE-SU-2024:10268-1

RHSA-2011:1391

RHSA-2011:1392

RHSA-2011_1391

RHSA-2011_1392

RHSA-2012:0542

Affected Products

Apache Http Server

Red Hat

Suse

References · 112

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/rewrite_proxy_bypass.rb · Exploit
• 🔥 http://exploit-db.com/exploits/17969 · Exploit
• 🔥 https://exploit-db.com/exploits/17969 · Exploit
• 🔥 http://web.archiveorange.com/archive/v/ZyS0hzECD5zzb2NkvQlt · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=740045 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:10268-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0543.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3368 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=nas2b7c57b1f1035675186257927003c8d48 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3368 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:144 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3368 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html · Vendor Advisory