CVE-2021-44224

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

Severity Score

8.2

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Un URI diseñado que es enviado a httpd configurado como proxy directo (ProxyRequests on) puede causar un fallo (desreferencia de puntero NULL) o, en el caso de configuraciones que mezclan declaraciones de proxy directo e inverso, puede permitir que las peticiones se dirijan a un endpoint de socket de dominio Unix declarado (Server Side Request Forgery). Este problema afecta a Apache HTTP Server versiones 2.4.7 hasta 2.4.51 (incluyéndola)

There's a null pointer dereference and server-side request forgery flaw in httpd's mod_proxy module, when it is configured to be used as a forward proxy. A crafted packet could be sent on the adjacent network to the forward proxy that could cause a crash, or potentially SSRF via misdirected Unix Domain Socket requests. In the worst case, this could cause a denial of service or compromise to confidentiality of data.

*Credits: 漂亮鼠, TengMA(@Te3t123)

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-11-25 CVE Reserved
2021-12-20 CVE Published
2024-08-04 CVE Updated
2024-09-04 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-476: NULL Pointer Dereference
CWE-918: Server-Side Request Forgery (SSRF)

CAPEC

References (21)

URL	Tag	Source
http://seclists.org/fulldisclosure/2022/May/33	Mailing List
http://seclists.org/fulldisclosure/2022/May/35	Mailing List
http://seclists.org/fulldisclosure/2022/May/38	Mailing List
http://www.openwall.com/lists/oss-security/2021/12/20/3	Mailing List
https://security.netapp.com/advisory/ntap-20211224-0001	Third Party Advisory
https://support.apple.com/kb/HT213255	Third Party Advisory
https://support.apple.com/kb/HT213256	Third Party Advisory
https://support.apple.com/kb/HT213257	Third Party Advisory
https://www.tenable.com/security/tns-2022-01	Third Party Advisory
https://www.tenable.com/security/tns-2022-03	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://www.oracle.com/security-alerts/cpuapr2022.html	2023-11-07
https://www.oracle.com/security-alerts/cpujan2022.html	2023-11-07

URL	Date	SRC
http://httpd.apache.org/security/vulnerabilities_24.html	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD	2023-11-07
https://security.gentoo.org/glsa/202208-20	2023-11-07
https://www.debian.org/security/2022/dsa-5035	2023-11-07
https://access.redhat.com/security/cve/CVE-2021-44224	2022-10-26
https://bugzilla.redhat.com/show_bug.cgi?id=2034672	2022-10-26

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Http Server Search vendor "Apache" for product "Http Server"				>= 2.4.7 < 2.4.52 Search vendor "Apache" for product "Http Server" and version " >= 2.4.7 < 2.4.52"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				34 Search vendor "Fedoraproject" for product "Fedora" and version "34"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				35 Search vendor "Fedoraproject" for product "Fedora" and version "35"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				36 Search vendor "Fedoraproject" for product "Fedora" and version "36"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0"		-		Affected
Tenable Search vendor "Tenable"		Tenable.sc Search vendor "Tenable" for product "Tenable.sc"				>= 5.14.0 < 5.20.0 Search vendor "Tenable" for product "Tenable.sc" and version " >= 5.14.0 < 5.20.0"		-		Affected
Tenable Search vendor "Tenable"		Tenable.sc Search vendor "Tenable" for product "Tenable.sc"				>= 5.16.0 < 202201.1 Search vendor "Tenable" for product "Tenable.sc" and version " >= 5.16.0 < 202201.1"		-		Affected
Oracle Search vendor "Oracle"		Communications Element Manager Search vendor "Oracle" for product "Communications Element Manager"				< 9.0 Search vendor "Oracle" for product "Communications Element Manager" and version " < 9.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Operations Monitor Search vendor "Oracle" for product "Communications Operations Monitor"				4.0 Search vendor "Oracle" for product "Communications Operations Monitor" and version "4.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Operations Monitor Search vendor "Oracle" for product "Communications Operations Monitor"				4.3 Search vendor "Oracle" for product "Communications Operations Monitor" and version "4.3"		-		Affected
Oracle Search vendor "Oracle"		Communications Operations Monitor Search vendor "Oracle" for product "Communications Operations Monitor"				4.4 Search vendor "Oracle" for product "Communications Operations Monitor" and version "4.4"		-		Affected
Oracle Search vendor "Oracle"		Communications Operations Monitor Search vendor "Oracle" for product "Communications Operations Monitor"				5.0 Search vendor "Oracle" for product "Communications Operations Monitor" and version "5.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Session Report Manager Search vendor "Oracle" for product "Communications Session Report Manager"				< 9.0 Search vendor "Oracle" for product "Communications Session Report Manager" and version " < 9.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Session Route Manager Search vendor "Oracle" for product "Communications Session Route Manager"				< 9.0 Search vendor "Oracle" for product "Communications Session Route Manager" and version " < 9.0"		-		Affected
Oracle Search vendor "Oracle"		Http Server Search vendor "Oracle" for product "Http Server"				-		-		Affected
Oracle Search vendor "Oracle"		Http Server Search vendor "Oracle" for product "Http Server"				12.2.1.3.0 Search vendor "Oracle" for product "Http Server" and version "12.2.1.3.0"		-		Affected
Oracle Search vendor "Oracle"		Http Server Search vendor "Oracle" for product "Http Server"				12.2.1.4.0 Search vendor "Oracle" for product "Http Server" and version "12.2.1.4.0"		-		Affected
Oracle Search vendor "Oracle"		Instantis Enterprisetrack Search vendor "Oracle" for product "Instantis Enterprisetrack"				17.1 Search vendor "Oracle" for product "Instantis Enterprisetrack" and version "17.1"		-		Affected
Oracle Search vendor "Oracle"		Instantis Enterprisetrack Search vendor "Oracle" for product "Instantis Enterprisetrack"				17.2 Search vendor "Oracle" for product "Instantis Enterprisetrack" and version "17.2"		-		Affected
Oracle Search vendor "Oracle"		Instantis Enterprisetrack Search vendor "Oracle" for product "Instantis Enterprisetrack"				17.3 Search vendor "Oracle" for product "Instantis Enterprisetrack" and version "17.3"		-		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		-		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2020-001		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2021-001		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2021-002		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2021-003		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2021-004		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2021-005		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2021-006		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2021-007		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2021-008		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2022-001		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2022-002		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.15.7 Search vendor "Apple" for product "Mac Os X" and version "10.15.7"		security_update_2022-003		Affected
Apple Search vendor "Apple"		Macos Search vendor "Apple" for product "Macos"				< 10.15.7 Search vendor "Apple" for product "Macos" and version " < 10.15.7"		-		Affected
Apple Search vendor "Apple"		Macos Search vendor "Apple" for product "Macos"				>= 11.0 < 11.6.6 Search vendor "Apple" for product "Macos" and version " >= 11.0 < 11.6.6"		-		Affected
Apple Search vendor "Apple"		Macos Search vendor "Apple" for product "Macos"				>= 12.0.0 < 12.4 Search vendor "Apple" for product "Macos" and version " >= 12.0.0 < 12.4"		-		Affected