On this page

Atomicorp WAF Research Note: CVE-2021-40438

Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery

CVE Details

Already protected by existing Atomicorp WAF rules
Protection status: Understanding Atomicorp WAF Protection Status
CVE: CVE-2021-40438
Name: Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery
Severity: Critical
CVSS: 9.0 (v3.1) (Critical)
CVSS version: 3.1
CVSS source: NVD
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- Attack vector: Network
- Attack complexity: High
- Privileges required: None
- User interaction: None
- Scope: Changed
- Confidentiality impact: High
- Integrity impact: High
- Availability impact: High
CWE: CWE-918 — Server-Side Request Forgery (SSRF)
Related CAPEC attack patterns (via MITRE CWE relationships): CAPEC-664 (opens in a new tab)
Vendor: apache
Vulnerable products: rocky linux , enterprise linux , enterprise linux eus , enterprise linux for arm 64 , enterprise linux for arm 64 eus , enterprise linux for ibm z systems , enterprise linux for ibm z systems eus , enterprise linux for ibm z systems eus s390x , enterprise linux for power big endian , enterprise linux for power little endian , enterprise linux for power little endian eus , enterprise linux for scientific computing , enterprise linux server , enterprise linux server aus , enterprise linux server for power little endian update services for sap solutions , enterprise linux server tus , enterprise linux server update services for sap solutions , enterprise linux update services for sap solutions , enterprise linux workstation , jboss core services , software collections , http server , fedora , debian linux , cloud backup , clustered data ontap , storagegrid , brocade fabric operating system firmware , f5os , enterprise manager ops center , http server , instantis enterprisetrack , secure global desktop , zfs storage appliance kit , ruggedcom nms , sinec nms , sinema remote connect server , sinema server , tenable.sc
CVE published: 2021-09-16
CVE last modified: 2026-08-06
Affected versions (NVD configurations):
- rocky linux: 8.0
- enterprise linux: 8.0
- enterprise linux eus: 8.1
- enterprise linux eus: 8.2
- enterprise linux eus: 8.4
- enterprise linux eus: 8.6
- enterprise linux eus: 8.8
- enterprise linux for arm 64: 8.0
- enterprise linux for arm 64 eus: 8.6
- enterprise linux for arm 64 eus: 8.8
- enterprise linux for ibm z systems: 7.0_s390x
- enterprise linux for ibm z systems: 8.0
- enterprise linux for ibm z systems eus: 8.1
- enterprise linux for ibm z systems eus: 8.4
- enterprise linux for ibm z systems eus: 8.8
- enterprise linux for ibm z systems eus s390x: 8.2
- enterprise linux for power big endian: 7.0
- enterprise linux for power little endian: 7.0
- enterprise linux for power little endian: 8.0
- enterprise linux for power little endian eus: 8.1
- enterprise linux for power little endian eus: 8.2
- enterprise linux for power little endian eus: 8.4
- enterprise linux for power little endian eus: 8.6
- enterprise linux for power little endian eus: 8.8
- enterprise linux for scientific computing: 7.0
- enterprise linux server: 7.0
- enterprise linux server aus: 7.2
- enterprise linux server aus: 7.3
- enterprise linux server aus: 7.4
- enterprise linux server aus: 7.6
- enterprise linux server aus: 7.7
- enterprise linux server aus: 8.2
- enterprise linux server aus: 8.4
- enterprise linux server aus: 8.6
- enterprise linux server for power little endian update services for sap solutions: 7.6
- enterprise linux server for power little endian update services for sap solutions: 7.7
- enterprise linux server for power little endian update services for sap solutions: 8.1
- enterprise linux server for power little endian update services for sap solutions: 8.2
- enterprise linux server for power little endian update services for sap solutions: 8.4
- enterprise linux server for power little endian update services for sap solutions: 8.6
- enterprise linux server for power little endian update services for sap solutions: 8.8
- enterprise linux server tus: 7.6
- enterprise linux server tus: 7.7
- enterprise linux server tus: 8.2
- enterprise linux server tus: 8.4
- enterprise linux server tus: 8.6
- enterprise linux server tus: 8.8
- enterprise linux server update services for sap solutions: 7.6
- enterprise linux server update services for sap solutions: 7.7
- enterprise linux update services for sap solutions: 8.1
- enterprise linux update services for sap solutions: 8.2
- enterprise linux update services for sap solutions: 8.4
- enterprise linux update services for sap solutions: 8.6
- enterprise linux update services for sap solutions: 8.8
- enterprise linux workstation: 7.0
- jboss core services: 1.0
- software collections: 1.0
- http server: <= 2.4.48
- fedora: 34
- fedora: 35
- debian linux: 9.0
- debian linux: 10.0
- debian linux: 11.0
- cloud backup
- clustered data ontap
- storagegrid
- brocade fabric operating system firmware
- f5os: >= 1.1.0, <= 1.1.4
- f5os: >= 1.2.0, <= 1.2.1
- enterprise manager ops center: 12.4.0.0
- http server: 12.2.1.3.0
- http server: 12.2.1.4.0
- instantis enterprisetrack: 17.1
- instantis enterprisetrack: 17.2
- instantis enterprisetrack: 17.3
- secure global desktop: 5.6
- zfs storage appliance kit: 8.8
- ruggedcom nms
- sinec nms: < 1.0.3
- sinema remote connect server: < 3.1
- sinema remote connect server: 3.2
- sinema server: 14.0
- tenable.sc: <= 5.19.1
EPSS: 1.0000; 100.0th percentile (FIRST (opens in a new tab) )
CISA KEV: Listed (added 2021-12-01)
- Known ransomware campaign use: Known
Latest Update: 2026-09-06
Selected Rule IDs observed: 345271 , 390723
Matching rules: 2; rules with blocking actions: 1
Would-block Rule IDs: 390723
Request surfaces inspected: Raw request URI, Request URI

Technical CPE data

This section lists vulnerable CPE matches retained from the NVD configurations. It supplements the readable affected-product information above.

cpe:2.3:o:resf:rocky_linux:8.0:*:*:*:*:*:*:*
- NVD match criteria ID: 55B10764-9920-49E3-B816-FCA37E546DF4
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- NVD match criteria ID: F4CFF558-3C47-480D-A2F0-BABF26042943
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
- NVD match criteria ID: 92BC9265-6959-4D37-BE5E-8C45E98992F8
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
- NVD match criteria ID: 831F0F47-3565-4763-B16F-C87B1FF2035E
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
- NVD match criteria ID: 0E3F09B5-569F-4C58-9FCA-3C0953D107B5
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
- NVD match criteria ID: 6C3741B8-851F-475D-B428-523F4F722350
cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*
- NVD match criteria ID: 62C31522-0A17-4025-B269-855C7F4B45C2
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:*
- NVD match criteria ID: 3F797F2E-00E6-4D03-A94E-524227529A0A
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6:*:*:*:*:*:*:*
- NVD match criteria ID: 3EFBEEE7-8BC5-4F4E-8EFA-42A6743152BB
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8:*:*:*:*:*:*:*
- NVD match criteria ID: 83981111-E13A-4A88-80FD-F63D7CCAA47F
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
- NVD match criteria ID: 2148300C-ECBD-4ED5-A164-79629859DD43
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
- NVD match criteria ID: 87C21FE1-EA5C-498F-9C6C-D05F91A88217
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:*
- NVD match criteria ID: 280D547B-F204-4848-9262-A103176B740C
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*
- NVD match criteria ID: 8C9BD9AE-46FC-4609-8D99-A3CFE91D58D1
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8:*:*:*:*:*:*:*
- NVD match criteria ID: 83364F5C-57F4-4D57-B54F-540CAC1D7753
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.2:*:*:*:*:*:*:*
- NVD match criteria ID: 725566B6-4319-489E-9A69-9E36ED2950DF
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*
- NVD match criteria ID: 1CDCFF34-6F1D-45A1-BE37-6A0E17B04801
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*
- NVD match criteria ID: B4A684C7-88FD-43C4-9BDB-AE337FCBD0AB
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
- NVD match criteria ID: 47811209-5CE5-4375-8391-B0A7F6A0E420
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:*
- NVD match criteria ID: 8EB6F417-25D0-4A28-B7BA-D21929EAA9E9
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*
- NVD match criteria ID: E5C80DB2-4A78-4EC9-B2A8-1E4D902C4834
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*
- NVD match criteria ID: 983533DD-3970-4A37-9A9C-582BD48AA1E5
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*
- NVD match criteria ID: 729C515E-1DD3-466D-A50B-AFE058FFC94A
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8:*:*:*:*:*:*:*
- NVD match criteria ID: A49ABD84-6755-4894-AD4E-49AAD39933C2
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
- NVD match criteria ID: 37CE1DC7-72C5-483C-8921-0B462C8284D1
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- NVD match criteria ID: 51EF4996-72F4-4FA4-814F-F5991E7A8318
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
- NVD match criteria ID: 1C8D871B-AEA1-4407-AEE3-47EC782250FF
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
- NVD match criteria ID: 98381E61-F082-4302-B51F-5648884F998B
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
- NVD match criteria ID: D99A687E-EAE6-417E-A88E-D0082BC194CD
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
- NVD match criteria ID: B353CE99-D57C-465B-AAB0-73EF581127D1
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
- NVD match criteria ID: 7431ABC1-9252-419E-8CC1-311B41360078
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
- NVD match criteria ID: 6897676D-53F9-45B3-B27F-7FF9A4C58D33
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
- NVD match criteria ID: E28F226A-CBC7-4A32-BE58-398FA5B42481
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
- NVD match criteria ID: 76C24D94-834A-4E9D-8F73-624AFA99AAA2
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*
- NVD match criteria ID: 57B5CF5A-D48E-4AD0-91E2-F5BDD44B7A66
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:*
- NVD match criteria ID: B6F33DBA-25BA-4A29-A80C-A9FB96FFE721
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*
- NVD match criteria ID: 4DF2B9A2-8CA6-4EDF-9975-07265E363ED2
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*
- NVD match criteria ID: 7DA6A5AF-2EBE-4ED9-B312-DCD9D150D031
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*
- NVD match criteria ID: 22D095ED-9247-4133-A133-73B7668565E4
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
- NVD match criteria ID: 871A5C26-DB7B-4870-A5B2-5DD24C90B4A7
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
- NVD match criteria ID: 12A809B2-2771-4780-9E0D-6A7B4A534CFB
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
- NVD match criteria ID: B76AA310-FEC7-497F-AF04-C3EC1E76C4CC
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
- NVD match criteria ID: 17F256A9-D3B9-4C72-B013-4EFD878BFEA8
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
- NVD match criteria ID: B09ACF2D-D83F-4A86-8185-9569605D8EE1
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
- NVD match criteria ID: AC10D919-57FD-4725-B8D2-39ECB476902F
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
- NVD match criteria ID: 1272DF03-7674-4BD4-8E64-94004B195448
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*
- NVD match criteria ID: F1CA946D-1665-4874-9D41-C7D963DD1F56
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*
- NVD match criteria ID: 5C450C83-695F-4408-8B4F-0E7D6DDAE345
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:*
- NVD match criteria ID: 3707B08D-8A78-48CB-914C-33A753D13FC7
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*
- NVD match criteria ID: 3ADDB02D-F377-43CE-B0A8-FC6C7D5CFABC
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*
- NVD match criteria ID: 15D3CC6E-3A8F-4694-B3CC-0DB12A3E9A0F
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*
- NVD match criteria ID: E881C927-DF96-4D2E-9887-FF12E456B1FB
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
- NVD match criteria ID: FB096D5D-E8F6-4164-8B76-0217B7151D30
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
- NVD match criteria ID: 01ED4F33-EBE7-4C04-8312-3DA580EFFB68
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- NVD match criteria ID: 825ECE2D-E232-46E0-A047-074B34DB1E97
cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*
- NVD match criteria ID: A2466282-51AB-478D-9FF4-FA524265ED2E
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
- NVD match criteria ID: 9D7EE4B6-A6EC-4B9B-91DF-79615796673F
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
- Version end (inclusive): 2.4.48
- NVD match criteria ID: 1691C7CE-5CDA-4B9A-854E-3B58C1115526
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- NVD match criteria ID: A930E247-0B43-43CB-98FF-6CE7B8189835
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- NVD match criteria ID: 80E516C0-98A4-4ADE-B69F-66A772E2BAAA
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- NVD match criteria ID: DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- NVD match criteria ID: 07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- NVD match criteria ID: FA6FEEC2-9F11-4643-8827-749718254FED
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
- NVD match criteria ID: 5C2089EE-5D7F-47EC-8EA5-0F69790564C4
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
- NVD match criteria ID: 1FE996B1-6951-4F85-AA58-B99A379D2163
cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*
- NVD match criteria ID: 8ADFF451-740F-4DBA-BD23-3881945D3E40
cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*
- NVD match criteria ID: B2748912-FC54-47F6-8C0C-B96784765B8E
cpe:2.3:o:f5:f5os:*:*:*:*:*:*:*:*
- Version start (inclusive): 1.1.0
- Version end (inclusive): 1.1.4
- NVD match criteria ID: 80A2EFAB-4D06-4254-B2FE-5D1F84BDFD3A
cpe:2.3:o:f5:f5os:*:*:*:*:*:*:*:*
- Version start (inclusive): 1.2.0
- Version end (inclusive): 1.2.1
- NVD match criteria ID: DBACFB6F-D57E-4ECA-81BB-9388E64F7DF3
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
- NVD match criteria ID: B095CC03-7077-4A58-AB25-CC5380CDCE5A
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*
- NVD match criteria ID: DFC79B17-E9D2-44D5-93ED-2F959E7A3D43
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
- NVD match criteria ID: AD04BEE5-E9A8-4584-A68C-0195CE9C402C
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*
- NVD match criteria ID: 82EA4BA7-C38B-4AF3-8914-9E3D089EBDD4
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*
- NVD match criteria ID: B9C9BC66-FA5F-4774-9BDA-7AB88E2839C4
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*
- NVD match criteria ID: 7F69B9A5-F21B-4904-9F27-95C0F7A628E3
cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:*
- NVD match criteria ID: 9DA11710-9EA8-49B4-8FD1-3AEE442F6ADC
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
- NVD match criteria ID: D3E503FB-6279-4D4A-91D8-E237ECF9D2B0
cpe:2.3:a:siemens:ruggedcom_nms:*:*:*:*:*:*:*:*
- NVD match criteria ID: 414A7F48-EFA5-4D86-9F8D-5A179A6CFC39
cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: BEF5E6CF-BBA5-4CCF-ACB1-BEF8D2C372B8
cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*
- Version end (exclusive): 3.1
- NVD match criteria ID: 98CC9C9A-FE14-4D50-A8EC-C309229356C8
cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:*:*:*:*:*:*:*
- NVD match criteria ID: D889831F-64D0-428A-A26C-71152C3B9974
cpe:2.3:a:siemens:sinema_server:14.0:-:*:*:*:*:*:*
- NVD match criteria ID: B0A5CC25-A323-4D49-8989-5A417D12D646
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*
- Version end (inclusive): 5.19.1
- NVD match criteria ID: A686FAF0-1383-4BBB-B7F5-CBCCAB55B356

Vulnerability Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Recommended Actions

Maintain the observed Atomicorp protections. Keep your Atomicorp commercial rules current and confirm that the selected observed rules (345271 , 390723 ) have not been locally disabled. Atomicorp commercial rules are enabled by default. If you use Atomic WAF, review the applicable policy and rule settings.
Apply the vendor’s remediation. WAF protection is defense in depth and does not replace upgrading or following the affected vendor’s guidance.
- Affected versions: Apache Software Foundation Apache HTTP Server versions through 2.4.48.
- The CVE record does not include written upgrade or workaround instructions, but it does publish the following patch or mitigation reference:
- CISA KEV required action: Apply updates per vendor instructions.
- CISA KEV federal remediation due date: 2021-12-15
Validate after changes. Confirm rule updates are current, review WAF events for the affected application, and test application behavior after vendor upgrades, mitigations, or local policy changes.

Research Notes

Atomicorp WAF protections are designed around attack techniques and exploit behaviors, allowing existing protections to apply across multiple vulnerabilities without requiring a unique rule for every CVE.

Public Vulnerability References

NVD (opens in a new tab)
CVE Record (opens in a new tab)
Exploit or technical research: https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf (opens in a new tab)
Vendor advisory: https://httpd.apache.org/security/vulnerabilities_24.html (opens in a new tab)
CVE authority reference: https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E (opens in a new tab)
CVE authority reference: https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E (opens in a new tab)
CVE authority reference: https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E (opens in a new tab)
CVE authority reference: https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E (opens in a new tab)
CVE authority reference: https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E (opens in a new tab)
CVE authority reference: https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E (opens in a new tab)
CVE authority reference: https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E (opens in a new tab)
Exploit or technical research: https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html (opens in a new tab)
Patch or mitigation: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/ (opens in a new tab)
Patch or mitigation: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/ (opens in a new tab)
Exploit or technical research: https://security.gentoo.org/glsa/202208-20 (opens in a new tab)
Exploit or technical research: https://security.netapp.com/advisory/ntap-20211008-0004/ (opens in a new tab)
Exploit or technical research: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ (opens in a new tab)
Exploit or technical research: https://www.debian.org/security/2021/dsa-4982 (opens in a new tab)
Patch or mitigation: https://www.oracle.com/security-alerts/cpuapr2022.html (opens in a new tab)
Patch or mitigation: https://www.oracle.com/security-alerts/cpujan2022.html (opens in a new tab)
Exploit or technical research: https://www.tenable.com/security/tns-2021-17 (opens in a new tab)
CVE authority reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438 (opens in a new tab)

Test or Research Source

Source: http/cves/2021/CVE-2021-40438.yaml (opens in a new tab)
Tags: apache, cve, cve2021, kev, mod-proxy, ssrf, vkev, vuln

Research Note Context

This research note documents exploit-technique analysis associated with this vulnerability and references Atomicorp WAF protections observed during engineering review, testing, or validation activities.

Atomicorp security controls are generally designed to identify and mitigate attack techniques and exploit behaviors rather than individual CVE identifiers. As a result, protections developed for one vulnerability may also apply to related attack variants and future vulnerabilities using similar techniques.

Learn More

Atomicorp develops commercially supported security technologies for web applications, servers, endpoints, workloads, and legacy enterprise platforms.

Organizations interested in protecting systems against exploit techniques associated with vulnerabilities such as this one can learn more about:

Atomic ModSecurity Rules: commercially maintained WAF rules for ModSecurity deployments, including protections for web attacks, bots, scanners, malware, exploitation attempts, and emerging vulnerability classes.
Atomic WAF: an enterprise web application firewall with Atomicorp rules, centralized management, reporting, authentication controls, and operational tooling.
Atomic ModSecurity Integrator: a special licensing option for MSPs, MSSPs, OEMs, VARs, reverse proxy providers, and other integrators who want to incorporate Atomicorp ModSecurity rule technology into their own products or services.
Atomic OSSEC: an enterprise OSSEC-based intrusion detection, compliance, and security monitoring platform.
Atomic Protector: workload protection for Linux, web, cloud, data center, and hybrid environments.

For additional information, product evaluations, or technical discussions, visit https://www.atomicorp.com/ or https://modsecurity.io/ (opens in a new tab) .