apache-httpd

Apache httpd Audit Findings

Security audit of Apache HTTP Server, the widely deployed web server. Each finding includes a detailed write-up and a patch.

Summary

Total findings: 56 -- High: 11, Medium: 39, Low: 6

Findings

Core request handling

#	Finding	Severity
069	htaccess cache omits override_list	Medium
073	Ignored path normalization failure	High
130	Out-of-bounds read on trailing CR	Medium

Configuration directives and overrides

#	Finding	Severity
029	Per-directory passphrase directive executes commands	Medium
063	Per-directory H2ProxyRequests enables server forward proxy	Medium

WebDAV (mod_dav)

#	Finding	Severity
003	Out-of-bounds read parsing Lock-Token	Low
027	Not locktokens satisfy lock validation	High
028	Lock owner check bypassed in token scan	High
056	Unescaped core property XML value	Medium

Authentication and authorization

#	Finding	Severity
004	Null request state dereference in ldap-search	Medium
024	Null nonce-count parsing	Medium
080	Unauthenticated open redirect on failed form auth	Medium
081	Open redirect after login handler authentication	Medium
083	Unchecked optional function pointer call in mod_authz_dbm	Medium
099	Null optional DBD acquire call (password)	Medium
100	Null optional DBD acquire call (realm)	Medium
109	Unchecked URI slash in authn socache key construction	Medium
137	Fake Authorization header logged	Medium

mod_ssl and OCSP

#	Finding	Severity
041	ALPN selection accepts protocol prefixes	Medium
108	commonName accepted despite DNS SAN	Medium
120	OCSP response times accepted without validity check	Medium

HTTP/2

#	Finding	Severity
064	Unbounded HTTP/2 priority recursion	Medium
129	Host authority mismatch is silently overwritten	Medium

mod_proxy_ftp

#	Finding	Severity
011	Unvalidated PASV data target	High
012	Unverified active FTP data peer	Medium

mod_proxy_ajp

#	Finding	Severity
068	Malformed Content-Length forwarded before validation	Medium
174	Header length check omits header bytes	High
175	uint8 getter reads at message end	Medium
176	String read ignores declared message length	Medium

Other proxy backends

#	Finding	Severity
059	Unbounded FastCGI header buffering	Medium
076	Out-of-bounds pointer on empty header in mod_proxy_http	Low
096	Empty response header underflows pointer in mod_proxy_uwsgi	Low

Proxy balancer and health checks

#	Finding	Severity
048	Unescaped health check expression in manager HTML	Medium
094	Unbounded health check body buffering	Medium
095	Invalid pointer for empty header value	Low
153	Negative ready inflates slot total	Medium

Heartbeat and clustering

#	Finding	Severity
060	Out-of-bounds terminator write for maximum heartbeat body	High
061	Missing busy/ready field check before atoi	Medium

Caching

#	Finding	Severity
025	Signed overflow in freshness calculation	Medium
084	Cross-origin cache invalidation ignores scheme and port	Medium

Filters and content rewriting

#	Finding	Severity
075	Header edit zero-length match recursion	Medium
116	Request body length desynchronization	Medium
117	InputSed filtering bypass by read mode	Medium
141	Out-of-bounds read in META header scan	High
161	Infinite loop on empty starred backreference	Medium
194	Signed overflow parsing rate limit	Medium
195	Signed overflow parsing initial burst	Low
196	Output buffer length not adjusted after skip	High
197	Null convset retained in conversion loop	Medium

Mappers and generators

#	Finding	Severity
035	Uninitialized PID cleanup in mod_cgid	Medium
092	Out-of-bounds URI suffix comparison in mod_speling	High
103	Unescaped variant list fields in error HTML	Medium
167	Unescaped imagemap comments in HTML menu	Medium

mod_remoteip

#	Finding	Severity
093	PROXY v2 length underflow exposes unreceived address bytes	High

Support utilities

#	Finding	Severity
021	suEXEC docroot prefix bypass	High
136	Newline injection in digest file records	Low