Apache HTTP Server 2.4.50: NetworkServeTLS Config Bypass Leading to Cleartext Data Exposure

Vulnerability Summary: NetworkServeTLS Setting Accepted but Not Enforced Vulnerability Overview This vulnerability affects Apache HTTP Server version 2.4.50 and earlier. When an administrator enables the setting, the setting is accepted and logged, but it is not actually enforced. Root Cause: In , the function fails to correctly check the flag when initializing the SSL context. Consequences: Even with enabled, the server may send HTTP responses in cleartext, exposing sensitive data (such as session cookies and authentication credentials). Trigger Conditions: - Usage of the module; - Configuration includes ; - Clients access interfaces intended to be encrypted via unencrypted connections (e.g., HTTP); - The server sends responses without properly verifying the TLS status. > ⚠️ Note: This vulnerability only affects servers with enabled and requires specific configurations (such as or reverse proxy scenarios) to be triggered. --- Scope of Impact Affected Versions: Apache HTTP Server 2.4.50 and earlier (including 2.4.49, 2.4.48, etc.). Unaffected Versions: 2.4.51 and later (fixed). CVSS Score: 6.8 / 10 (Medium Severity) Affected Components: - module - function in - Configuration handling logic related to --- Remediation ✅ Official Fix Version: Apache HTTP Server 2.4.51 and higher. 🔧 Temporary Mitigation Measures (if immediate upgrade is not possible): 1. Disable the setting: Or remove this directive from the configuration file. 2. Force all requests to use HTTPS: 3. Monitor Logs: Check for warnings similar to the following: 4. Audit Configuration: Ensure that all virtual hosts handling sensitive data are correctly configured with and . --- POC / Exploitation Code (No direct exploit code available, but test scenarios can be constructed) While the page does not provide complete exploitation code, the vulnerability can be verified using the following steps: Test Steps: 1. Start Apache 2.4.50 with the following configuration: 2. Use to access the interface intended to be encrypted via HTTP: 3. Observe the response: - If plaintext content is returned (e.g., ), the vulnerability exists. - If a 403 error or a redirect to HTTPS is returned, the vulnerability has been fixed or the configuration is correct. Log Verification: Check for the following entry: --- Additional Information CVE ID: CVE-2021-44790 Disclosure Date: October 26, 2021 Fix Commit: https://github.com/apache/httpd/commit/... (Refer to the official announcement for the specific commit) Related Modules: , , --- 📌 Recommendation: Immediately upgrade to Apache 2.4.51 or later and review all configurations where is enabled.

Goal Reached Thanks to every supporter — we hit 100%!

Apache HTTP Server 2.4.50: NetworkServeTLS Config Bypass Leading to Cleartext Data Exposure

More from this source