Apache HTTP Server Buffer Overflow Vulnerability in mod_lua

A buffer overflow vulnerability has been identified in the Apache HTTP Server mod_lua module, specifically in versions through 2.4.52. This vulnerability allows a carefully crafted request body to be parsed by the Lua script engine, leading to a memory overwrite. The issue was discovered by Chamal De Silva and is classified as moderate severity.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution or a crash of the Apache HTTP Server process.

Reproduction

To reproduce this vulnerability, send a request with a crafted body that exploits the Lua multipart parser. This can be done by uploading a file through a web form that triggers the parsing of the request body by a Lua script.

Remediation

Users can upgrade to Apache HTTP Server version 2.4.53 or later, which addresses this vulnerability.