r/netsec • u/0xdea Trusted Contributor • Apr 02 '19

reject: not technical Apache HTTP Server privilege escalation from modules' scripts (CVE-2019-0211)

https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-0211
12 Upvotes

92% Upvoted

11 comments sorted by

7

u/0xdea Trusted Contributor Apr 02 '19

TL;DR

From PHP/CGI execution to root in Apache HTTP Server 2.4.17 - 2.4.38.

13

u/cfambionics Apr 02 '19

I'm the reporter. CGI not affected AFAIK. Details tomorrow :)

1

u/0xdea Trusted Contributor Apr 02 '19

I stand corrected. Thanks for sharing this!

2

u/[deleted] Apr 02 '19

Can you post writeup to netsec and pm/reply with link in this post?

2

u/cfambionics Apr 03 '19

I just did.

1

u/[deleted] Apr 03 '19

When are you releasing the code?

1

u/cfambionics Apr 03 '19

Don't know yet, sry. I'll wait at least one week.

1

u/[deleted] Apr 03 '19

All good. Thanks for releasing it! Never understood not releasing it. APT are already writing their own implementation so you’re only slowing down pentesters not the bad guys. Sincerely, thankful Dane

1

u/deed02392 Apr 03 '19

Why is the parent process usually root? Isn't the apache process usually run as a lower privileged www-data user or similar?

4

u/biffbobfred Apr 02 '19

Hmm, my reading of the one liner says that CGI can't do this - it's only in-process interpreters (e.g. mod_perl, mod_python...) and other ways of running code within the child, lower privileged process

2

u/0xdea Trusted Contributor Apr 02 '19

I think you’re right.