cbcvebase.
CVE-2019-0211
published 2019-04-08

CVE-2019-0211: In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including…

PriorityP190high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
65.00%
99.2th percentile
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Affected

69 ranges· showing 25
VendorProductVersion rangeFixed in
apacheapache_http_server
apachehttp_server2.4.17 – 2.4.38
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debianapache2< apache2 2.4.38-3 (bookworm)apache2 2.4.38-3 (bookworm)
debiandebian_linux
fedoraprojectfedora
fedoraprojectfedora
fedoraprojectfedora
opensuseleap
opensuseleap
oraclecommunications_session_report_manager
oraclecommunications_session_report_manager
oraclecommunications_session_report_manager
oraclecommunications_session_report_manager
oraclecommunications_session_route_manager
oraclecommunications_session_route_manager
oraclecommunications_session_route_manager
oraclecommunications_session_route_manager
oracleenterprise_manager_ops_center
oracleenterprise_manager_ops_center
oraclehttp_server
oracleinstantis_enterprisetrack

Detection & IOCsextracted from sources · hover to see the quote

commandchmod +s /usr/bin/python3.5
  • Monitor for Apache graceful restart (apache2ctl graceful) triggered unexpectedly or outside of scheduled logrotate windows, as exploitation requires a graceful restart to execute the privilege escalation via scoreboard manipulation.
  • Detect HTTP requests containing a 'cmd' parameter targeting Apache worker processes, as the PoC exploit accepts arbitrary OS commands via $_REQUEST['cmd'] to be executed as root.
  • Alert on unexpected setuid bit changes (chmod +s) on system binaries such as Python interpreters, which is the default payload of the published PoC exploit.
  • Detect PHP scripts running inside Apache worker processes that instantiate DateInterval objects in rapid succession or trigger use-after-free (UAF) patterns, as the PoC uses PHP DateInterval UAF to gain read/write primitives over the Apache scoreboard shared memory.
  • Alert on Apache HTTP Server versions 2.4.17 through 2.4.38 running on Unix with MPM event, worker, or prefork, as these are the exclusively affected configurations.
  • In shared hosting environments, monitor for cross-user file access or privilege escalation to root originating from web worker processes, as the exploit is particularly impactful where multiple users share a single Apache host.
  • ·Only Unix-based systems running Apache HTTP Server 2.4.17–2.4.38 with MPM event, worker, or prefork are affected. Non-Unix systems are explicitly not vulnerable.
  • ·Exploitation requires the attacker to already have read/write access to an Apache worker process (e.g., via a separate exploit or malicious script), making this a local privilege escalation rather than a remote code execution vulnerability.
  • ·The PoC payload size is constrained to 152 bytes (264 - 112); payloads exceeding this limit will cause the exploit to exit without executing.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vulncheck7.8HIGH
cisa7.8HIGH
vendor_debian7.8HIGH
vendor_oracle7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.