Finding Apache HTTP Server instances
Rumble Network Discovery is now runZero!
Update: The 2.4.50 fix was incomplete and we strongly recommend upgrading to 2.4.51 or newer.
The Apache Software Foundation recently announced a path traversal vulnerability present in version 2.4.49 of the Apache HTTP Server software. Due to insufficient coverage of potential path traversal characters in the URL, an unauthenticated attacker can read files outside of the document root and even execute system commands in some configurations. While this vulnerability (CVE-2021-41773) only affects version 2.4.49 (and 2.4.50 as a variant), it was exploited in the wild to Apache publishing their security advisory.
How to find Apache HTTP Server with Rumble
From the Service Inventory, use the following pre-built query to locate vulnerable Apache HTTP Server instances in your network:
product:"apache httpd" AND protocol:http AND (http.head.server:"Apache/2.4.49" OR http.head.server:"Apache/2.4.50")
As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries.
Try Rumble
Don’t have Rumble and need help finding your Apache HTTP Server instances? Start your Rumble trial today.
Similar Content
February 15, 2023
Finding OpenSSH servers
The OpenSSH team surfaced a security issue earlier this month that specifically affects OpenSSH server version 9.1p1 (a.k.a. version 9.1). This version contains a memory double-free vulnerability (tracked as CVE-2023-25136) that can be reached pre-authentication by a remote …
Read MoreFebruary 8, 2023
Finding VMware ESXi assets
This Rapid Response post covers ESXiArgs, a new strain of ransomware that is targeting VMware ESXi servers. Learn how you can find potentially affected servers on your network.
February 3, 2023
Finding Lexmark printer assets
Printer manufacturer Lexmark recently published details on a vulnerability that affects over 100 of their printer models. Learn how runZero can help you find potentially affected assets.