CVE-2021-40438
Apache HTTP Server-Side Request Forgery (SSRF)
Description
CVE-2021-40438 is a server-side request forgery vulnerability in the mod_proxy module of Apache HTTP Server: a crafted request URI path causes mod_proxy to forward the request to an origin server chosen by the remote user rather than the one the configuration intended. Apache HTTP Server 2.4.48 and earlier are affected, and because mod_proxy is ubiquitous in reverse-proxy and load-balancer deployments, the flaw turns a front-end web server into a relay for reaching internal services that should never be exposed. Rated CVSS 9.0 (Critical) with a changed scope, CVE-2021-40438 carries an EPSS score of 99.999% — effectively the maximum on the scale — and the CISA KEV entry now records known use in ransomware campaigns, an escalation over its earlier status. The KEV remediation due date was 2021-12-15, so any system still running an affected build has been overdue for years while the exploitation likelihood has stayed at the ceiling.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| resf | rocky linux | 8.0 |
| redhat | enterprise linux | 8.0 |
| redhat | enterprise linux eus | 8.1; 8.2; 8.4; 8.6; 8.8 |
| redhat | enterprise linux for arm 64 | 8.0 |
| redhat | enterprise linux for arm 64 eus | 8.6; 8.8 |
| redhat | enterprise linux for ibm z systems | 7.0_s390x; 8.0 |
| redhat | enterprise linux for ibm z systems eus | 8.1; 8.4; 8.8 |
| redhat | enterprise linux for ibm z systems eus s390x | 8.2 |
| redhat | enterprise linux for power big endian | 7.0 |
| redhat | enterprise linux for power little endian | 7.0; 8.0 |
| redhat | enterprise linux for power little endian eus | 8.1; 8.2; 8.4; 8.6; 8.8 |
| redhat | enterprise linux for scientific computing | 7.0 |
| redhat | enterprise linux server | 7.0 |
| redhat | enterprise linux server aus | 7.2; 7.3; 7.4; 7.6; 7.7; 8.2; 8.4; 8.6 |
| redhat | enterprise linux server for power little endian update services for sap solutions | 7.6; 7.7; 8.1; 8.2; 8.4; 8.6; 8.8 |
| redhat | enterprise linux server tus | 7.6; 7.7; 8.2; 8.4; 8.6; 8.8 |
| redhat | enterprise linux server update services for sap solutions | 7.6; 7.7 |
| redhat | enterprise linux update services for sap solutions | 8.1; 8.2; 8.4; 8.6; 8.8 |
| redhat | enterprise linux workstation | 7.0 |
| redhat | jboss core services | 1.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf(Third Party Advisory)
- https://httpd.apache.org/security/vulnerabilities_24.html(Release Notes, Vendor Advisory)
- https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E(Mailing List)
- https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/(Release Notes)
- https://security.gentoo.org/glsa/202208-20(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20211008-0004/(Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ(Broken Link, Third Party Advisory)
- https://www.debian.org/security/2021/dsa-4982(Mailing List, Third Party Advisory)
- https://www.oracle.com/security-alerts/cpuapr2022.html(Patch, Third Party Advisory)
- https://www.oracle.com/security-alerts/cpujan2022.html(Patch, Third Party Advisory)
- https://www.tenable.com/security/tns-2021-17(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery occurs when an application fetches a remote resource without validating the user-supplied destination, letting an attacker coerce the server into sending requests somewhere unintended even when a firewall, VPN, or access control list stands in the way. In Apache HTTP Server the crafted URI path steers mod_proxy to an attacker-chosen origin, so the proxy itself performs the request from its own trusted network position, which is exactly the primitive used to reach internal services, cloud metadata endpoints, and internal APIs that are unreachable from outside.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2021-40438 has a CVSS 3.1 base score of 9.0 (Critical): remotely exploitable without physical access, needing no authentication and no user action, with high attack complexity because the request must be crafted against a proxy configuration that reaches the vulnerable code path. The decisive metric is the changed scope — an SSRF in a reverse proxy affects resources beyond the vulnerable component by design. Confidentiality (High): the attacker reads responses from internal systems the proxy can reach, which commonly includes admin interfaces, internal APIs, and cloud metadata services that hand out credentials. Integrity (High): requests forged through the proxy can perform state-changing actions on those internal systems, since they arrive from a trusted source address. Availability (High): the proxy can be directed at internal endpoints in ways that exhaust resources or disrupt backend services. The EPSS score of 99.999% means exploitation is not a probability but an ongoing certainty, and the KEV ransomware flag confirms that this SSRF is used as an access vector in extortion campaigns rather than only for reconnaissance. Because the affected component sits at the network edge with routes into the internal network, an unpatched Apache instance is one of the most consequential exposures a perimeter can carry.
Exploit Maturity
CVE-2021-40438 is at the absolute top of the exploitation scale: the EPSS score is 99.999% in the 99.997th percentile, which indicates certain, continuous exploitation rather than a forecast, and the CISA KEV entry — with a due date of 2021-12-15 — now marks the vulnerability as known to be used in ransomware campaigns, a change from its earlier record. No exploit-tagged references are present in the available sources, which comprise the Apache HTTP Server vulnerabilities page, several Apache users and bugs mailing-list threads, the Debian LTS announcement, and Siemens SSA-685781; that absence is immaterial for a vulnerability of this age, since the technique has been public and automated for years. The practical assessment is unambiguous: this is one of the most reliably exploited web-server vulnerabilities in circulation, it is being used to gain access in ransomware operations, and any Apache HTTP Server at 2.4.48 or earlier — including instances embedded in appliances and vendor products — needs to be patched immediately and then examined for signs of prior use.
Remediation
- Follow the CISA KEV required action: apply updates per vendor instructions. The due date of 2021-12-15 is long past, so remediation on any affected system is severely overdue.
- Upgrade Apache HTTP Server to a release newer than 2.4.48, as documented on the Apache HTTP Server 2.4 vulnerabilities page. Where the server comes from a distribution, install the patched vendor package instead of building from source: the affected inventory includes Red Hat Enterprise Linux 7 and 8 and their EUS, AUS, TUS and SAP variants across x86, Arm 64, IBM Z and Power, Rocky Linux 8.0, and Red Hat JBoss Core Services 1.0, with the corresponding Debian fix announced in the Debian LTS advisory.
- For industrial and embedded products that bundle Apache HTTP Server, follow the vendor's own guidance — Siemens documents affected products and fixes in SSA-685781 — since these systems are often patched on a separate release cycle from the operating system.
- Reduce SSRF reach until every proxy is patched: restrict outbound connections from the proxy tier with egress filtering so it can only reach the backends it legitimately serves, block access to cloud metadata addresses such as 169.254.169.254 from the proxy host, and review
ProxyPassandRewriteRuleconfigurations for patterns that allow a user-influenced path to determine the upstream target. - Given the ransomware association, hunt as well as patch: review Apache access logs for unusual URI paths against proxy endpoints and for proxied requests to unexpected upstream hosts, check internal service logs for requests originating from the proxy's address that no legitimate flow explains, rotate any credentials that could have been retrieved from internal endpoints or metadata services, and confirm offline backups are restorable. As long-term hardening against CWE-918, validate and allowlist every user-supplied destination, permit only required URL schemes, and block requests to private and link-local IP ranges.
Technical Details
The defect in CVE-2021-40438 is that mod_proxy derives the upstream target from a request URI path that a remote user can craft, so instead of forwarding to the configured origin server it forwards to one the attacker selects (CWE-918). The proxy then executes the request with its own network identity, which is what makes SSRF valuable: the request originates inside the trust boundary, bypassing the firewall rules, VPN segmentation, and access control lists that would block the same request from outside. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H accounts for the 9.0 score: network delivery (AV:N), no privileges (PR:N), and no user interaction (UI:N), with AC:H reflecting that a suitable proxy configuration and a correctly shaped URI path are required, and S:C recording that the impact lands on systems other than the web server itself. Confidentiality, integrity, and availability are all rated High because an SSRF primitive against internal services can read data, trigger actions, and disrupt backends depending on what the proxy can reach. Apache HTTP Server 2.4.48 and all earlier releases contain the flaw, and it reaches downstream in numerous vendor rebuilds and appliances.
Frequently Asked Questions
Is CVE-2021-40438 being actively exploited?
Yes, and it is used in ransomware campaigns. CVE-2021-40438 is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2021-12-15, and the KEV entry now records known ransomware use. Its EPSS score of 99.999% sits in the 99.997th percentile, effectively the maximum, indicating continuous exploitation activity across the internet.
What products are affected by CVE-2021-40438?
The vulnerability affects Apache HTTP Server 2.4.48 and all earlier versions through the mod_proxy module. Because distributions and vendors ship Apache, the affected inventory also covers Red Hat Enterprise Linux 7 and 8 with their EUS, AUS, TUS and SAP update streams across x86, Arm 64, IBM Z and Power, Rocky Linux 8.0, Red Hat JBoss Core Services 1.0, and Siemens products that bundle the web server.
How do I fix CVE-2021-40438?
Upgrade Apache HTTP Server to a release newer than 2.4.48, or install the patched package from your distribution or appliance vendor, following the Apache HTTP Server 2.4 vulnerabilities page and, for Siemens products, advisory SSA-685781. Until every proxy is patched, apply egress filtering on the proxy tier, block access to cloud metadata addresses, and review proxy configurations where a user-influenced path can determine the upstream target.
How severe is CVE-2021-40438?
CVE-2021-40438 is rated Critical with a CVSS 3.1 base score of 9.0: unauthenticated and remote with high impact on confidentiality, integrity, and availability, and a changed scope because the SSRF affects systems behind the proxy rather than the web server alone. With an EPSS score at essentially 100% and a KEV ransomware flag, its real-world severity is as high as it gets for a perimeter component.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.