CVE-2011-3368 The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch patter...
MediumCVSS 5.0
EPSS 90.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/apache2(Debian:12) | < 2.2.21-2 | 2.2.21-2 |
| debian/apache2(Debian:13) | < 2.2.21-2 | 2.2.21-2 |
| debian/apache2(Debian:14) | < 2.2.21-2 | 2.2.21-2 |
| Apache HTTP Server | = 1.3 | No fix listed |
| Apache HTTP Server | = 1.3.0 | No fix listed |
| Apache HTTP Server | = 1.3.1 | No fix listed |
| Apache HTTP Server | = 1.3.1.1 | No fix listed |
| Apache HTTP Server | = 1.3.2 | No fix listed |
| Apache HTTP Server | = 1.3.3 | No fix listed |
| Apache HTTP Server | = 1.3.4 | No fix listed |
| Apache HTTP Server | = 1.3.5 | No fix listed |
| Apache HTTP Server | = 1.3.6 | No fix listed |
| Apache HTTP Server | = 1.3.7 | No fix listed |
| Apache HTTP Server | = 1.3.8 | No fix listed |
| Apache HTTP Server | = 1.3.9 | No fix listed |
| Apache HTTP Server | = 1.3.10 | No fix listed |
| Apache HTTP Server | = 1.3.11 | No fix listed |
| Apache HTTP Server | = 1.3.12 | No fix listed |
| Apache HTTP Server | = 1.3.13 | No fix listed |
| Apache HTTP Server | = 1.3.14 | No fix listed |
| Apache HTTP Server | = 1.3.15 | No fix listed |
| Apache HTTP Server | = 1.3.16 | No fix listed |
| Apache HTTP Server | = 1.3.17 | No fix listed |
| Apache HTTP Server | = 1.3.18 | No fix listed |
| Apache HTTP Server | = 1.3.19 | No fix listed |
Show 78 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | = 1.3.20 | No fix listed |
| Apache HTTP Server | = 1.3.22 | No fix listed |
| Apache HTTP Server | = 1.3.23 | No fix listed |
| Apache HTTP Server | = 1.3.24 | No fix listed |
| Apache HTTP Server | = 1.3.25 | No fix listed |
| Apache HTTP Server | = 1.3.26 | No fix listed |
| Apache HTTP Server | = 1.3.27 | No fix listed |
| Apache HTTP Server | = 1.3.28 | No fix listed |
| Apache HTTP Server | = 1.3.29 | No fix listed |
| Apache HTTP Server | = 1.3.30 | No fix listed |
| Apache HTTP Server | = 1.3.31 | No fix listed |
| Apache HTTP Server | = 1.3.32 | No fix listed |
| Apache HTTP Server | = 1.3.33 | No fix listed |
| Apache HTTP Server | = 1.3.34 | No fix listed |
| Apache HTTP Server | = 1.3.35 | No fix listed |
| Apache HTTP Server | = 1.3.36 | No fix listed |
| Apache HTTP Server | = 1.3.37 | No fix listed |
| Apache HTTP Server | = 1.3.38 | No fix listed |
| Apache HTTP Server | = 1.3.39 | No fix listed |
| Apache HTTP Server | = 1.3.41 | No fix listed |
| Apache HTTP Server | = 1.3.42 | No fix listed |
| Apache HTTP Server | = 1.3.65 | No fix listed |
| Apache HTTP Server | = 1.3.68 | No fix listed |
| Apache HTTP Server | = 2.0 | No fix listed |
| Apache HTTP Server | = 2.0.9 | No fix listed |
| Apache HTTP Server | = 2.0.28 | No fix listed |
| Apache HTTP Server | = 2.0.28-beta | No fix listed |
| Apache HTTP Server | = 2.0.32 | No fix listed |
| Apache HTTP Server | = 2.0.32-beta | No fix listed |
| Apache HTTP Server | = 2.0.34-beta | No fix listed |
| Apache HTTP Server | = 2.0.35 | No fix listed |
| Apache HTTP Server | = 2.0.36 | No fix listed |
| Apache HTTP Server | = 2.0.37 | No fix listed |
| Apache HTTP Server | = 2.0.38 | No fix listed |
| Apache HTTP Server | = 2.0.39 | No fix listed |
| Apache HTTP Server | = 2.0.40 | No fix listed |
| Apache HTTP Server | = 2.0.41 | No fix listed |
| Apache HTTP Server | = 2.0.42 | No fix listed |
| Apache HTTP Server | = 2.0.43 | No fix listed |
| Apache HTTP Server | = 2.0.44 | No fix listed |
| Apache HTTP Server | = 2.0.45 | No fix listed |
| Apache HTTP Server | = 2.0.46 | No fix listed |
| Apache HTTP Server | = 2.0.47 | No fix listed |
| Apache HTTP Server | = 2.0.48 | No fix listed |
| Apache HTTP Server | = 2.0.49 | No fix listed |
| Apache HTTP Server | = 2.0.50 | No fix listed |
| Apache HTTP Server | = 2.0.51 | No fix listed |
| Apache HTTP Server | = 2.0.52 | No fix listed |
| Apache HTTP Server | = 2.0.53 | No fix listed |
| Apache HTTP Server | = 2.0.54 | No fix listed |
| Apache HTTP Server | = 2.0.55 | No fix listed |
| Apache HTTP Server | = 2.0.56 | No fix listed |
| Apache HTTP Server | = 2.0.57 | No fix listed |
| Apache HTTP Server | = 2.0.58 | No fix listed |
| Apache HTTP Server | = 2.0.59 | No fix listed |
| Apache HTTP Server | = 2.0.60 | No fix listed |
| Apache HTTP Server | = 2.0.61 | No fix listed |
| Apache HTTP Server | = 2.0.63 | No fix listed |
| Apache HTTP Server | = 2.0.64 | No fix listed |
| Apache HTTP Server | = 2.2.0 | No fix listed |
| Apache HTTP Server | = 2.2.1 | No fix listed |
| Apache HTTP Server | = 2.2.2 | No fix listed |
| Apache HTTP Server | = 2.2.3 | No fix listed |
| Apache HTTP Server | = 2.2.4 | No fix listed |
| Apache HTTP Server | = 2.2.6 | No fix listed |
| Apache HTTP Server | = 2.2.8 | No fix listed |
| Apache HTTP Server | = 2.2.9 | No fix listed |
| Apache HTTP Server | = 2.2.10 | No fix listed |
| Apache HTTP Server | = 2.2.11 | No fix listed |
| Apache HTTP Server | = 2.2.12 | No fix listed |
| Apache HTTP Server | = 2.2.13 | No fix listed |
| Apache HTTP Server | = 2.2.14 | No fix listed |
| Apache HTTP Server | = 2.2.15 | No fix listed |
| Apache HTTP Server | = 2.2.16 | No fix listed |
| Apache HTTP Server | = 2.2.18 | No fix listed |
| Apache HTTP Server | = 2.2.19 | No fix listed |
| Apache HTTP Server | = 2.2.20 | No fix listed |
| Apache HTTP Server | = 2.2.21 | No fix listed |
References
- Debian Security Tracker CVE-2011-3368 vendor-advisory
- kb.juniper.net
- APPLE-SA-2012-09-19-2 vendor-advisory
- SUSE-SU-2011:1229 vendor-advisory
- openSUSE-SU-2013:0243 vendor-advisory
- openSUSE-SU-2013:0248 vendor-advisory
- SSRT100772 vendor-advisory
- SSRT100966 vendor-advisory
- 76079 vdb-entry
- RHSA-2012:0542 vendor-advisory
- RHSA-2012:0543 vendor-advisory
- 20111005 Apache HTTP Server: mod_proxy reverse proxy exposure (CVE-2011-3368) mailing-list
- 20111005 Context IS Advisory - Apache Reverse Proxy Bypass Vulnerability mailing-list
- 46288 third-party-advisory
- 46414 third-party-advisory
- 48551 third-party-advisory
- support.apple.com
- svn.apache.org patch
- [announce] 20111005 Advisory: mod_proxy reverse proxy exposure (CVE-2011-3368) exploit mailing-list patch
- SE49723 vendor-advisory
- SE49724 vendor-advisory
- www.contextis.com
- DSA-2405 vendor-advisory
- 17969 exploit
- MDVSA-2011:144 vendor-advisory
- MDVSA-2013:150 vendor-advisory
- www.oracle.com
- www.oracle.com
- RHSA-2011:1391 vendor-advisory
- RHSA-2011:1392 vendor-advisory
- 49957 vdb-entry
- 1026144 vdb-entry
- bugzilla.redhat.com exploit patch
- apache-modproxy-information-disclosure(70336) vdb-entry
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1888222 - in /httpd/site/trunk/content/security/json: CVE-2010-2068.json CVE-2010-2791.json CVE-2011-0419.json CVE-2011-3368.json mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [8/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [7/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list