CVE-2021-26690: Apache HTTP Server DoS Vulnerability

CVE-2021-26690 Overview

CVE-2021-26690 is a NULL pointer dereference vulnerability affecting Apache HTTP Server versions 2.4.0 through 2.4.46. The vulnerability exists within the mod_session module, which fails to properly handle specially crafted Cookie headers. When exploited, this flaw causes the server process to crash, resulting in a Denial of Service (DoS) condition that can impact the availability of web services running on affected systems.

Critical Impact

Remote attackers can crash Apache HTTP Server instances without authentication by sending malicious Cookie headers, causing service disruption for all users relying on the affected web server.

Affected Products

• Apache HTTP Server versions 2.4.0 to 2.4.46
• Debian Linux 9.0 and 10.0
• Fedora 34 and 35
• Oracle Enterprise Manager Ops Center 12.4.0.0
• Oracle Instantis EnterpriseTrack 17.1, 17.2, and 17.3
• Oracle ZFS Storage Appliance Kit 8.8

Discovery Timeline

• June 10, 2021 - CVE-2021-26690 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-26690

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference) and affects the mod_session module in Apache HTTP Server. The flaw occurs when the module processes Cookie headers that have been specially crafted to trigger an invalid memory access condition. When the vulnerable code path attempts to dereference a NULL pointer during session cookie parsing, the server process terminates abnormally.

The attack can be executed remotely over the network without requiring any authentication or user interaction. While the vulnerability does not allow for data exfiltration or code execution, its impact on service availability makes it a significant concern for production web servers. Organizations using mod_session for session management are particularly at risk.

Root Cause

The root cause lies in insufficient input validation within the mod_session module when processing Cookie header values. The code fails to properly check for NULL values before dereferencing pointers during the session cookie parsing routine. When a malformed Cookie header bypasses initial validation checks, subsequent operations assume valid pointer references, leading to the NULL pointer dereference and immediate process crash.

Attack Vector

The attack vector is network-based and requires no special privileges or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a target Apache HTTP Server with mod_session enabled
2. Crafting a malicious HTTP request containing a specially formatted Cookie header designed to trigger the NULL pointer condition
3. Sending the request to the server, causing the worker process to crash
4. Repeating the attack to maintain denial of service conditions

The vulnerability can be triggered by any unauthenticated remote user who can send HTTP requests to the affected server. Since mod_session is commonly used for session state management in web applications, many Apache installations may be vulnerable if they have not been patched.

Detection Methods for CVE-2021-26690

Indicators of Compromise

• Unexpected Apache HTTP Server child process crashes or restarts in error logs
• Repeated segmentation fault entries in system logs associated with httpd processes
• Abnormal patterns of incoming requests with malformed or unusually structured Cookie headers
• Service availability issues correlating with specific incoming HTTP traffic patterns

Detection Strategies

• Monitor Apache error logs for segmentation fault messages or NULL pointer dereference indicators
• Implement Web Application Firewall (WAF) rules to detect and block malformed Cookie headers
• Use intrusion detection systems to identify repeated crash-and-restart patterns indicative of DoS attacks
• Deploy network traffic analysis to identify suspicious request patterns targeting session handling endpoints

Monitoring Recommendations

• Enable detailed logging for mod_session module operations to capture anomalous session handling events
• Configure alerting on Apache child process crash rates exceeding normal thresholds
• Implement real-time monitoring of web server availability and response times to detect service degradation
• Review access logs for requests containing unusual Cookie header structures

How to Mitigate CVE-2021-26690

Immediate Actions Required

• Upgrade Apache HTTP Server to version 2.4.47 or later, which contains the fix for this vulnerability
• If immediate patching is not possible, consider temporarily disabling mod_session if not required for application functionality
• Implement WAF rules to filter potentially malicious Cookie headers
• Review server configurations to ensure only necessary modules are enabled

Patch Information

Apache has released version 2.4.47 which addresses this vulnerability. Administrators should consult the Apache HTTP Server Vulnerabilities page for official patch information. Distribution-specific patches are also available:

• Debian users should apply updates per DSA-4937 and the Debian LTS Announcement
• Fedora users should apply updates per the Fedora Package Announcements
• Gentoo users should refer to GLSA 202107-38
• Oracle customers should consult the Oracle Security Alert CPU Oct 2021

Workarounds

• Disable the mod_session module if session management functionality is not required by your applications
• Implement rate limiting on incoming connections to reduce the impact of potential DoS attacks
• Deploy a reverse proxy or load balancer in front of Apache servers to provide an additional layer of request filtering
• Configure server monitoring to automatically restart crashed processes while investigating the root cause

# Disable mod_session module on Debian/Ubuntu systems
sudo a]2dismod session
sudo a2dismod session_cookie
sudo systemctl restart apache2

# Disable mod_session module on RHEL/CentOS by commenting out in config
# Edit /etc/httpd/conf.modules.d/01-session.conf
# Comment out: LoadModule session_module modules/mod_session.so
# Then restart: sudo systemctl restart httpd