CVE-2021-40438: Resf Rocky Linux SSRF Vulnerability

CVE-2021-40438 Overview

CVE-2021-40438 is a Server-Side Request Forgery (SSRF) vulnerability in the mod_proxy module of Apache HTTP Server 2.4.48 and earlier. A crafted request URI-path can cause mod_proxy to forward the request to an origin server chosen by the remote attacker. The flaw is tracked as [CWE-918] and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Attackers exploit this issue to reach internal services, bypass network segmentation, and pivot into restricted backend infrastructure. The vulnerability affects a wide range of downstream products that bundle Apache HTTPD, including Red Hat Enterprise Linux, Oracle HTTP Server, NetApp, Siemens, F5, and Cisco appliances.

Critical Impact

Unauthenticated remote attackers can coerce vulnerable reverse-proxy deployments into forwarding requests to attacker-controlled or internal origin servers, enabling SSRF, internal reconnaissance, and downstream compromise.

Affected Products

• Apache HTTP Server 2.4.48 and earlier (versions with mod_proxy enabled)
• Red Hat Enterprise Linux 7 and 8, Rocky Linux 8, Fedora 34/35, Debian 9/10/11
• Oracle HTTP Server 12.2.1.3.0 and 12.2.1.4.0, Oracle ZFS Storage Appliance Kit 8.8, NetApp StorageGRID, F5 F5OS, Siemens SINEC/SINEMA, Tenable.sc

Discovery Timeline

• 2021-09-16 - CVE-2021-40438 published to the National Vulnerability Database (NVD)
• 2025-10-27 - Last updated in NVD database

Technical Details for CVE-2021-40438

Vulnerability Analysis

The vulnerability resides in Apache HTTP Server's mod_proxy module, which forwards client requests to backend origin servers in reverse-proxy configurations. A specially crafted URI-path manipulates how mod_proxy parses the request target and selects the upstream worker. The attacker can override the intended backend and force the proxy to issue an HTTP request to an arbitrary host. Because the request originates from the trusted proxy host, it can reach internal services that are otherwise unreachable from the public internet. The flaw is classified as Server-Side Request Forgery [CWE-918].

Root Cause

The defect lies in mod_proxy's handling of a malformed URI-path supplied in the request line. When the path contains specific characters that confuse the URI parser, the worker-selection logic dereferences attacker-influenced data and substitutes the configured upstream URL with one constructed from the request. The proxy then opens a TCP connection to that destination and forwards the original request body and headers. The fix in Apache HTTPD 2.4.49 (and subsequent backports) hardens URI validation and prevents the override of the configured worker URL.

Attack Vector

Exploitation requires only network access to a vulnerable Apache reverse-proxy endpoint. The attacker sends an HTTP request whose URI-path is crafted to manipulate mod_proxy worker resolution. No authentication or user interaction is needed. Successful exploitation lets the attacker target internal management interfaces, cloud metadata services such as 169.254.169.254, or other intranet-only hosts. CISA confirms active exploitation in the wild, and an EPSS probability of 94.432% (99.98 percentile) indicates a very high likelihood of continued attempted exploitation.

No verified public exploit code is republished here. Technical details are available in the Apache HTTPD Vulnerabilities Listing and the Cisco Security Advisory for Apache HTTPD.

Detection Methods for CVE-2021-40438

Indicators of Compromise

• Apache access_log entries containing unusual URI-paths with embedded @, additional schemes, or encoded characters preceding the expected proxied path.
• Outbound connections from the Apache host to internal RFC1918 ranges, link-local 169.254.169.254, or unexpected external hosts not present in ProxyPass configuration.
• mod_proxyerror_log entries referencing workers or hostnames that were never explicitly configured.
• Anomalous spikes in proxied 5xx responses correlated with malformed request lines.

Detection Strategies

• Inspect HTTP request lines for unbalanced or unusual characters in the URI-path arriving at hosts running Apache HTTPD with mod_proxy enabled.
• Correlate inbound web requests with outbound socket activity from the Apache process to flag proxying toward unintended destinations.
• Apply WAF or IDS signatures published by Cisco, Tenable, and Apache for CVE-2021-40438; many vendors shipped network rules in late 2021.
• Audit httpd -M and active ProxyPass/ProxyPassMatch directives against running Apache versions reported by httpd -v.

Monitoring Recommendations

• Track Apache HTTPD version inventory across all hosts and alert on any instance running 2.4.48 or earlier.
• Monitor egress traffic from reverse-proxy tiers and enforce egress allowlists limited to declared backend origins.
• Forward Apache access and error logs to a centralized analytics pipeline to enable retroactive hunting for SSRF patterns.

How to Mitigate CVE-2021-40438

Immediate Actions Required

• Upgrade Apache HTTP Server to 2.4.49 or later, or apply the vendor-backported package for your distribution (Red Hat, Debian, Ubuntu, SUSE, Rocky).
• For appliances bundling Apache (Oracle, NetApp, F5, Siemens, Cisco, Tenable), apply vendor firmware or patch updates referenced in their respective advisories.
• Restrict outbound network access from reverse-proxy hosts to only the declared backend origins.
• Review mod_proxy configuration and disable the module on servers that do not require proxying.

Patch Information

Apache HTTPD 2.4.49 contains the upstream fix. Vendor patches and advisories are available from the Apache HTTPD Vulnerabilities Listing, Debian Security Announcement DSA-4982, Gentoo GLSA 2022-08-20, NetApp Security Advisory NTAP-20211008, Cisco Security Advisory for Apache HTTPD, Oracle Security Alert CPUJAN2022, Oracle Security Alert CPUAPR2022, and Siemens Security Advisory SSA-685781. The CISA Known Exploited Vulnerabilities Catalog mandates remediation for U.S. federal agencies.

Workarounds

• Place a strict WAF in front of Apache that rejects requests with malformed URI-paths or non-printable characters before they reach mod_proxy.
• Disable mod_proxy and related submodules (mod_proxy_http, mod_proxy_ajp, mod_proxy_wstunnel) on any host that does not require reverse-proxy functionality.
• Apply host-based firewall rules to whitelist only configured backend IPs as valid outbound destinations from the Apache process.

# Verify Apache version and disable mod_proxy if not required
httpd -v
a2dismod proxy proxy_http proxy_ajp proxy_wstunnel
systemctl restart apache2

# Example egress allowlist (iptables) limiting Apache to a single backend
iptables -A OUTPUT -m owner --uid-owner apache -d 10.0.0.10 -p tcp --dport 8080 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner apache -j REJECT