Apache HTTP Server Server Side Includes Query String Injection Vulnerability

A vulnerability exists in Apache HTTP Server versions prior to 2.4.66, specifically in versions 2.4.65 and earlier, when Server Side Includes (SSI) are enabled and mod_cgid is active (but not mod_cgi). In this scenario, the server improperly passes the shell-escaped query string to #exec cmd="..." directives, potentially leading to unintended command execution.

Impact

Exploitation of this vulnerability could allow for injection of shell-escaped query strings into executed commands, potentially leading to command execution on the server.

Reproduction

To reproduce this vulnerability, enable Server Side Includes (SSI) and mod_cgid on an Apache HTTP Server instance running version 2.4.65 or earlier. Then, send a request with a crafted query string that exploits the #exec cmd="..." directive. The injected query string will be passed to the command execution context, demonstrating the vulnerability.

Remediation

Users are advised to upgrade to Apache HTTP Server version 2.4.66 or later, which addresses this vulnerability.