Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a…
Apache Software Foundation · Apache HTTP Server
The flaw is in Apache HTTP Server (Apache Software Foundation), where a use-after-free in the handling of the Limit directive can cause secret data from process memory to be exposed. An unauthenticated remote attacker can exploit it by sending an OPTIONS HTTP request, but only when the Limit directive can be set in a user's .htaccess file or httpd.conf has certain misconfigurations, and the data returned depends on many configuration factors and is not always disclosed.
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 4 years after disclosure. Public exploit code (Exploit-DB) was available the same day.
- First seen exploitedVulnCheck KEV evidence+4 yrs
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 5 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files21 May 2024
- smtech.hr - 194.135.80.88 - #FANOS - vuln to 24 CVE's19 May 2022
- SMS Phisphing Campaign16 May 2022
- 103.224.212.227 - cve-2019-0220 cdn/supplychain18 Apr 2022
- Internal CVE Research9 Mar 2022