CVE-2018-8011
published 2018-07-18CVE-2018-8011: By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used…
PriorityP277high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
51.71%
98.8th percentile
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | — | — |
| debian | apache2 | < apache2 2.4.34-1 (bookworm) | apache2 2.4.34-1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
commandGET http://${Host} HTTP/1.1
Host: ${Host}
- →The DoS trigger is an HTTP request using an absolute-form request-target (full URI in the request line, e.g. 'GET http://<host> HTTP/1.1') directed at a server running Apache HTTP Server 2.4.33 with mod_md enabled. This causes the mod_md challenge handler to dereference a NULL pointer and segfault the child process. ↗
- →Detection probe: send a valid GET request first and confirm the Server header matches 'Apache/([0-9.]+)' (specifically 2.4.33), then send the absolute-form DoS request. If the connection drops/errors, the target is vulnerable.
- →Affected component is mod_md (ACME/Let's Encrypt module), first introduced as experimental in Apache httpd 2.4.30 (first released in 2.4.32). Only servers with mod_md loaded are exploitable. ↗
- →Monitor Apache httpd child process segfaults (SIGSEGV) in error logs, particularly when mod_md is active, as an indicator of exploitation attempts. ↗
- ·Vulnerability only affects Apache HTTP Server version 2.4.33 exactly. Versions 2.4.30–2.4.31 were never released; 2.4.32 introduced mod_md but is not listed as affected by this CVE. All Red Hat Enterprise Linux packages are listed as 'Not affected', suggesting mod_md was not shipped/enabled in those builds. ↗
- ·mod_md must be loaded and active for the vulnerability to be exploitable. Servers without mod_md enabled are not at risk. ↗
- ·The nuclei detection template uses stop-at-first-match and tests both ports 80 and 443, excluding port 0. The detection logic infers vulnerability by observing connection failure after the DoS request — this is a destructive/active check that may actually crash the target child process.
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vulncheck7.5HIGH
vendor_apache7.5
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2018-8011: By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault
osv·2018-07-18·CVSS 7.5
CVE-2018-8011 [HIGH] CVE-2018-8011: By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
VulnCheck
Apache HTTP Server NULL Pointer Dereference
vulncheck·2018·CVSS 7.5
CVE-2018-8011 [HIGH] Apache HTTP Server NULL Pointer Dereference
Apache HTTP Server NULL Pointer Dereference
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
Affected: Apache HTTP Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.trendmicro.com/en_us/research/22/b/recent-cyberattacks-open-source-web-servers.html
Red Hat
httpd: mod_md: NULL pointer dereference causing httpd child process crash
vendor_redhat·2018-07-18·CVSS 7.5
CVE-2018-8011 [HIGH] CWE-476 httpd: mod_md: NULL pointer dereference causing httpd child process crash
httpd: mod_md: NULL pointer dereference causing httpd child process crash
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
Package: httpd (Red Hat Enterprise Linux 6) - Not affected
Package: httpd (Red Hat Enterprise Linux 7) - Not affected
Package: httpd (Red Hat Enterprise Linux 8) - Not affected
Package: httpd (Red Hat JBoss Core Services) - Not affected
Package: httpd (Red Hat JBoss Enterprise Application Platform 5) - Not affected
Package: httpd (Red Hat JBoss Enterprise Application Platform 6) - Not affected
Package: httpd (Red Hat JBoss Enterprise Web Server 2) - Not affected
Package: httpd (Re
Debian
CVE-2018-8011: apache2 - By specially crafting HTTP requests, the mod_md challenge handler would derefere...
vendor_debian·2018·CVSS 7.5
CVE-2018-8011 [HIGH] CVE-2018-8011: apache2 - By specially crafting HTTP requests, the mod_md challenge handler would derefere...
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
Scope: local
bookworm: resolved (fixed in 2.4.34-1)
bullseye: resolved (fixed in 2.4.34-1)
forky: resolved (fixed in 2.4.34-1)
sid: resolved (fixed in 2.4.34-1)
trixie: resolved (fixed in 2.4.34-1)
Apache
Apache httpd: CVE-2018-8011
vendor_apache·CVSS 7.5
CVE-2018-8011 Apache httpd: CVE-2018-8011
Apache httpd: CVE-2018-8011
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Acknowledgements: The issue was discovered by Daniel Caminada . Reported to security team 2018-06-29 Issue public 2018-07-18 Update 2.4.34 released 2018-07-15 Affects 2.4.33
Severity: moderate
No detection rules found.
Nuclei
Apache HTTP Server - NULL Pointer Dereference
nuclei·CVSS 7.5
CVE-2018-8011 [HIGH] Apache HTTP Server - NULL Pointer Dereference
Apache HTTP Server - NULL Pointer Dereference
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33)
Template:
id: CVE-2018-8011
info:
name: Apache HTTP Server - NULL Pointer Dereference
author: daffainfo
severity: high
description: |
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33)
impact: |
Attackers can cause server crashes leading to denial of service, disrupting service availability.
remediation: |
Update to version 2.4.34 or lat
Trendmicro
Cyberangriffe auf Open Source-Webserver
blogs_trendmicro·2022-03-03·CVSS 9.8
[CRITICAL] Cyberangriffe auf Open Source-Webserver
APT und gezielte Angriffe
## Cyberangriffe auf Open Source-Webserver
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Angriffe wie die Ausführung von Remote-Code, die Umgehung von Zugriffskontrollen, Denial-of-Service oder Cyberjacking dienen dem Mining von Kryptowährungen.
By: Jon Clay Mar 03, 2022 Read time: ( words)
Save to Folio
Originalartikel von Jon Clay, VP, Threat Intelligence
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Böswillige Akteure setzen dabei auf Angriffe wie Remote Code Execution (RCE), Umgehung der Zugriffskontrolle, Denial of Service (DoS) oder sogar Cyberjacking, um auf den Servern der Opfer Kryptowährungen zu schürfen. Um Unternehmen vor bösartigen Aktivitäten zu schützen, bedarf
Trendmicro
Recent Cyberattacks Increasingly Target Open-source Web Servers
blogs_trendmicro·2022-02-22·CVSS 9.8
CVE-2021-44228 [CRITICAL] Recent Cyberattacks Increasingly Target Open-source Web Servers
APT & Targeted Attacks
# Recent Cyberattacks Target Open-source Web Servers
Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution, access control bypass, denial of service, or even cyberjacking the victim servers to mine cryptocurrencies.
By: Jon Clay
2022/02/22
Read time: ( words)
Save to Folio
As organizations reeled from the Log4Shell vulnerability (CVE-2021-44228), cyberattacks aiming at open-source web servers, like Apache HTTP Server, were rapidly rising. Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution (RCE), access control bypass, denial of service (DoS), or even cyberjacking the victim servers to mine cryptocurrencies.
To protect enterprises against m
Bugzilla
CVE-2018-8011 httpd: mod_md: NULL pointer dereference causing httpd child process crash [fedora-all]
bugzilla·2018-07-20·CVSS 7.5
CVE-2018-8011 [HIGH] CVE-2018-8011 httpd: mod_md: NULL pointer dereference causing httpd child process crash [fedora-all]
CVE-2018-8011 httpd: mod_md: NULL pointer dereference causing httpd child process crash [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mult
Bugzilla
CVE-2018-8011 httpd: mod_md: NULL pointer dereference causing httpd child process crash
bugzilla·2018-07-20·CVSS 7.5
CVE-2018-8011 [HIGH] CVE-2018-8011 httpd: mod_md: NULL pointer dereference causing httpd child process crash
CVE-2018-8011 httpd: mod_md: NULL pointer dereference causing httpd child process crash
Apache httpd before version 2.4.34 has a vulnerability in mod_md. By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server.
External References:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-8011
Discussion:
The affected mod_md module was only introduced upstream in version 2.4.30 as an experimental module:
*) mod_md: new experimental, module for managing domains across virtual hosts,
implementing the Let's Encrypt ACMEv1 protocol to signup and renew
certificates. Please read the modules documentation for further instructions
on how to use it. [Stefan Eissin
http://www.securitytracker.com/id/1041401https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-8011https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20180926-0007/http://www.securitytracker.com/id/1041401https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-8011https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20180926-0007/
2018-07-18
Published
Exploited in the wild