Apache HTTP Server Flaws Fuel Millions of Exploit Detections

Attackers weaponized at least 15 of 57 Apache HTTP Server vulnerabilities identified over a five-year period, according to Trend Micro research published in February 2022. Exploitation included denial of service, path traversal, server-side request forgery (SSRF), and remote code execution. By the end of 2021, Trend Micro had recorded more than four million exploit detections associated with CVE-2021-41773 and CVE-2021-42013; those detections do not establish an equivalent number of successful compromises.

Another exploited flaw, CVE-2021-40438, enables unauthenticated SSRF through Apache’s mod_proxy module and affects multiple vendors’ products. CISA added it to its Known Exploited Vulnerabilities catalog on December 1, 2021. Compromised web servers can be used for cryptojacking, spam, phishing, and attacks against other servers. Organizations should identify affected Apache deployments and embedded components through software composition analysis and continuous exposure assessment, prioritize patches for actively exploited flaws, and use virtual patching or intrusion prevention while permanent fixes are prepared.