Some Critical and Important Apache Vulnerabilities
Hi Fellas,
Today I wanted to share with you the vulnerabilities that you should either test on Apache or that should never be present in your Apache application. The CVEs I have shared with you are important for Apache as a result of my personal experiences and research. The Apache CVEs that I have shared with you here also include version information and software class information. This information is described as Tips. You can compare your current Apache version and features with these Tips. I also thought it would be right to share the PoC links with you so that you can test it quickly.
Note: I did not want to include the Log4j vulnerability, whose criticality level is well known, here because I wanted the article to be more specific.
Let’s get started.
1 — CVE-2021-41773
CVSS:
- 7.5 High
Tip(s):
- Just HTTP Server 2.4.49 version
PoC Link(s):
- https://github.com/iilegacyyii/PoC-CVE-2021-41773
- https://github.com/lorddemon/CVE-2021-41773-PoC
- http://exploit-db.com/exploits/50383
2 — CVE-2024-50379
CVSS:
- 9.8 Critical
Tip(s):
- Time-of-check Time-of-use (TOCTOU)
- 11.0.0-M1 through 11.0.1
- 10.1.0-M1 through 10.1.33
- 9.0.0.M1 through 9.0.97
PoC Link(s):
- https://github.com/dragonked2/CVE-2024-50379-POC
- https://medium.com/@patelvidhi4288/deep-dive-poc-of-cve-2024-50379-exploit-tomcat-vulnerability-9-8-severity-776cfcfcf3ed
- https://github.com/Alchemist3dot14/CVE-2024-50379
3 — CVE-2024-38473
CVSS:
- 8.1 High
Tip(s):
- mod_proxy in Apache HTTP Server 2.4.59 and earlier
PoC Link(s):
- https://github.com/Abdurahmon3236/CVE-2024-38473
- https://github.com/juanschallibaum/CVE-2024-38473-Nuclei-Template
4 — CVE-2024-27316
CVSS:
- 7.5 High
Tip(s):
- nghttp2
- HTTP/2
PoC Link(s):
5 — CVE-2021-27850
CVSS:
- 9.8 Critical
Tip(s):
- Apache Tapestry’s 5.4.5, 5.5.0, 5.6.2 and 5.7.0.
PoC Link(s):
6 — CVE-2023-50164
CVSS:
- 9.8 Critical
Tip(s):
- Apache Struts
PoC Link(s):
- https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCE
- https://github.com/snyk-labs/CVE-2023-50164-POC
7 — CVE-2022-42889
CVSS:
- 9.8 Critical
Tip(s):
- 1.5 and continuing through 1.9 in Apache Commons Text
PoC Link(s):
- https://x.com/sheikhrishad0/status/1583485229452627969
- https://github.com/SeanWrightSec/CVE-2022-42889-PoC
- https://github.com/korteke/CVE-2022-42889-POC
8— CVE-2024-38856
CVSS:
- 8.1 High
- 9.8 Critical
Tip(s):
- This issue affects Apache OFBiz: through 18.12.14.
PoC Link(s):
- https://github.com/securelayer7/CVE-2024-38856_Scanner
- https://www.zscaler.com/blogs/security-research/cve-2024-38856-pre-auth-rce-vulnerability-apache-ofbiz
9 — CVE-2023–25690
CVSS:
- 9.8 Critical
Tip(s):
- mod_proxy on Apache HTTP Server versions 2.4.0 through 2.4.55.
PoC Link(s):
10 — CVE-2022-40127
CVSS:
- 8.8 High
Tip(s):
- Apache Airflow Apache Airflow versions prior to 2.4.0.
PoC Link(s):
Thank you for your interest in this content. You can also listen to the song of this content here. Stay safe and take care!
Maybe this article may interest you.
