Vulnerability Disclosure: Apache Privilege Escalation

On April 01 2019, Apache released a security advisory for Apache 2.4. The advisory contained 6 vulnerabilities, where 1 of them is a privilege escalation vulnerability. In versions 2.4.17 to 2.4.38, with MPM event, worker or prefork, a specifically crafted user supplied script can be executed by the Apache webserver and provide privileges of its parent process, which is usually root. This privilege escalation is serious due to the widespread use of Apache, especially on shared web hosting servers, which can give an attacker access to all of the websites hosted on the server. As of 02 April 2019, there is no proof of concept seen in the wild.

Recommendations

• If your organization runs Apache 2.4.17 to 2.4.38, update to the latest patch
• Implement custom rule in the ZeroFOX platform to monitor for reports of vulnerabilities that may affect your technical stack
• Implement a custom rule in the ZeroFOX platform to monitor for Proof of Concepts of this vulnerability and other vulnerabilities you are concerned about

Details

The Multi-Processing Module (MPM) is an Apache Module that allows requests to be served simultaneously by passing work to listener threads. The disclosure specifically states that these child processes or threads could be executing scripts by an in-process scripting interpreter which allows arbitrary code execution of the parent process. Web hosting services generally allow their customers to execute scripts as part of their service contract, so a malicious or compromised host can abuse the MPM relationship and this vulnerability to gain access to the parent process, giving the attacker access to all other websites and their data on the machine.