Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
CVE-2021-44790

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Http Server
Vendor
CVE Published:
20 December 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 85%

What is CVE-2021-44790?

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Affected Version(s)

Apache HTTP Server Apache HTTP Server 2.4 <= 2.4.51

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

-CVE-2021-44790
Created by nuPacaChi

References

http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
mailing-list
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory

EPSS Score

85% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chamal
Anonymous working with Trend Micro Zero Day Initiative
.