Vulnerability Alert - Apache HTTP Server
A vulnerability has been identified in mod_proxy on Apache HTTP Servers. This vulnerability refers to mid-September, however it is being actively exploited.
Thus, only versions prior to 2.4.48 are affected and the servers that have the module mod_proxy active.
The vulnerability is characterized by a crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.
If this vulnerability is successfully exploited, it allows an unauthenticated attacker to perform Server-Side Request Forgery (SSRF) attacks.
Although the Apache Software Foundation published the security update for this vulnerability, it is already out dated, so it is recommended to upgrade to the latest version — 2.4.51.
[1] https://securityaffairs.co/wordpress/125107/hacking/cve-2021-40438-apache-http-server-attacks.html
[2] https://httpd.apache.org/security/vulnerabilities_24.html#2.4.49