CVE-2021-40438

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.48 and earlier

Description: A crafted request uri-path can cause mod proxy to forward the request to an origin server chosen by the remote user. This issue is related to insufficient validation of incoming requests, allowing a remote attacker to perform a Server-Side Request Forgery (SSRF) attack. The estimated number of potentially affected devices worldwide is not specified. There are reports of real-world incidents where this issue was exploited.

Recommendations: For Apache HTTP Server versions 2.4.48 and earlier, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the mod proxy module to minimize the risk of exploitation. Avoid using vulnerable configurations that allow an attacker to manipulate the request uri-path until the issue is resolved.