Maximize your protection, eliminate business risks.
Optimize and modernize with cloud transformation.
Empower your people to work securely from anywhere.
Let us handle IT so you can focus on growing your business.
Get multichannel 24/7/365 expert end-user support.
Stay ahead of attacks with 24/7 protection and monitoring.
Maximize uptime with with industry-leading DRaaS.
Improve efficiency, productivity and outcomes with cloud.
Ensure all mobile devices, everywhere, are secure.
Gain a competitive edge with strategic IT solutions.
This battle-tested checklist enables your team to swiftly initiate a ransomware response.
IT for businesses of all sizes, in any industry.
Empower institution growth with custom IT solutions.
Ensure your firm is always in compliance.
Improve patient care and staff morale.
Deal with pressing legal matters, not IT.
Keep up with the evolving digital landscape.
Focus on your mission by outsourcing IT.
Accelerate PE client deals and secure data.
Leverage your technology as a strategic asset.
Execute initiatives and develop IT strategies.
Get the latest industry insights and trends.
Join us at events in person and online.
Hear from clients and learn more about strategic IT.
See how Dataprise can make IT your greatest asset.
Get informative technical resources from IT experts.
Stay on stop of emerging cybersecurity threats.
Discover the key areas of DR your organization needs to address to ensure downtime is minimized.
Gain a strategic asset by bringing harmony to IT.
Ensure 24/7 support and security with dedicated teams.
Drive business forward by partnering with Dataprise.
Meet our one-of-a-kind leadership team.
Discover the recognition Dataprise has earned.
Help us help businesses with strategic IT.
Embracing different perspectives and backgrounds.
Find a Dataprise location near you.
Dataprise is committed to empowering more women to consider a career in technology.
Posts
By: Dataprise
Table of content
Apache has issued a patch that addresses a zero day vulnerability in its HTTP web server project. Apache is an open-source web server for Unix and Windows that is among the most widely used web servers in the world. Successful exploitation could allow unauthorized users to trick the web server into returning files they should not be able to access, which could lead to further attacks or the compromise of data.
Attackers could use a path traversal attack to map URLs to files outside the expected document root, accessing unauthorized files.
Apache has issued a patch for CVE-2021-41773 that addresses a vulnerability in its HTTP web server 2.4.49. This vulnerability allows attackers to map URLs to files outside the expected document root and could leak the “source of interpreted files like CGI scripts [1],” which can lead to further attacks.
This vulnerability affects all files outside of the document root that are not protected by the ‘require all denied’ setting.
Positive Technologies Offensive Team was able to reproduce the path traversal exploit, and posted this proof of concept on their Twitter account.
According to Tenable, “Just under 112,000 Apache HTTP Servers are running the vulnerable version.” Since version 2.4.49 was released just over 2 weeks ago, it’s likely that many admins have not yet updated their servers to this version. If this is the case, it is recommended to skip version 2.4.49 and patch directly to 2.4.50.
Any Apache HTTP Servers running version 2.4.49 (this vulnerability does not affect older versions) are currently exposed.
Files outside of the document root not protected by ‘require all denied’ are at risk.
Apache Web Servers should be updated to version 2.4.50 immediately.
Administrators should protect files outside of the document root with ‘require all denied’.
INSIGHTS
Subscribe to our blog to learn about the latest IT trends and technology best practices.