{"vulnerability": "CVE-2021-44790", "sightings": [{"uuid": "5897817c-85f1-4dcb-b8b2-33d4cc90a998", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44790", "type": "seen", "source": "https://t.me/true_secator/2485", "content": "Apache Software Foundation \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0441\u0440\u043e\u0447\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0445 CVE-2021-44790 \u0438 CVE-2021-44224 \u0432\u043e \u0444\u043b\u0430\u0433\u043c\u0430\u043d\u0441\u043a\u043e\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0435 Apache HTTP Server, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c\u00a0 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 CVE-2021-44790 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043c\u043d\u043e\u0433\u043e\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043d\u043e\u043c \u043f\u0430\u0440\u0441\u0435\u0440\u0435 mod_lua \u0432 Apache HTTP Server 2.4.51 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Apache Software Foundation \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e\u00a0 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0435\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f.\n\n\u0414\u0440\u0443\u0433\u0430\u044f CVE-2021-44224 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u0443\u044e \u0442\u043e\u0447\u043a\u0443 Unix Domain Socket, \u0432\u044b\u0437\u044b\u0432\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435\u043c NULL \u0438\u043b\u0438 SSRF \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u044f\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438 \u0432 Apache HTTP Server 2.4.51 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache \u0432 \u0441\u0435\u0442\u0438 \u0438 \u043d\u0430\u0447\u0430\u0432\u0448\u0443\u044e\u0441\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0434\u0440\u0443\u0433\u043e\u0439 CVE-2021-40438 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 SSRF \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u043a\u0440\u043e\u0441\u0441\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043d\u0435\u0437\u0430\u043c\u0435\u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043e \u0447\u0435\u043c \u0442\u0430\u043a\u0436\u0435 \u043e\u0437\u0430\u0431\u043e\u0442\u0438\u043b\u043e\u0441\u044c CISA, \u0441\u043f\u0435\u0448\u043d\u043e \u0434\u043e\u0431\u0430\u0432\u0438\u0432 \u043d\u043e\u0432\u044b\u0435 \u0431\u0430\u0433\u0438 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 CVE.", "creation_timestamp": "2021-12-28T16:00:47.000000Z"}, {"uuid": "b00b43e3-7356-42a9-b579-d1cc6bfa01ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44790", "type": "seen", "source": "https://t.me/cibsecurity/34272", "content": "\u203c CVE-2021-44790 \u203c\n\nA carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-20T14:39:58.000000Z"}, {"uuid": "eeac8f11-185e-4d56-a4d0-e04bd87b66d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44790", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/5284", "content": "#Threat_Research\n1. Qiling Sandbox Escape\nhttps://www.kalmarunionen.dk/writeups/2022/rwctf/qlaas\n2. Code Execution on Apache via an Integer Underflow (CVE-2021-44790)\nhttps://www.zerodayinitiative.com/blog/2022/1/25/cve-2021-44790-code-execution-on-apache-via-an-integer-underflow", "creation_timestamp": "2022-01-27T11:07:01.000000Z"}, {"uuid": "d4a0929b-460f-4de2-be5e-959840816c05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44790", "type": "seen", "source": "https://t.me/poxek/322", "content": "#news \u0423\u0441\u0442\u0430\u043b\u0438 \u0443\u0436\u0435 \u0441\u043b\u0443\u0448\u0430\u0442\u044c \u043f\u0440\u043e Log4j, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0434\u043e\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438\u0437 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0443\u0442\u044e\u0433\u0430? \u041f\u043e\u043d\u0438\u043c\u0430\u044e. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u043e\u0442 \u0432\u0430\u043c \u0435\u0449\u0451 \u0434\u0432\u0435 \u043d\u043e\u0432\u0435\u043d\u044c\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0432 Apache HTTPD: CVE-2021-44790 \u0438 CVE-2021-44224.\n\n\u0427\u0442\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e: \n\u22c5 CVE-2021-44790 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430, CVE-2021-44224 \u2014 \u0441 \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f;\n\u22c5 \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0435\u0440\u0441\u0438\u0438 2.4.51 \u0438 \u0441\u0442\u0430\u0440\u0448\u0435;\n\u22c5 \u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c;\n\u22c5 \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u044d\u0442\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430 \u043e\u0434\u043d\u043e\u0437\u043d\u0430\u0447\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0433\u0440\u043e\u0436\u0430\u044e\u0442 RCE \u0438 DoS-\u0430\u0442\u0430\u043a\u0430\u043c\u0438.\n\nHTTPD, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u043f\u043e \u0441\u0432\u043e\u0435\u0439 \u0432\u0435\u0437\u0434\u0435\u0441\u0443\u0449\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u0441\u0438\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0443\u043f\u0430\u0435\u0442 Log4j, \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0435\u0434\u0440\u0435\u043a\u0430\u044e\u0442 \u043d\u043e\u0432\u0443\u044e \u0440\u0430\u0434\u043e\u0441\u0442\u043d\u0443\u044e \u0432\u043e\u043b\u043d\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0443\u0436\u0435 \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412\u0435\u0441\u0451\u043b\u044b\u0439 \u043a\u043e\u043d\u0435\u0446 \u0433\u043e\u0434\u0430 \u0432\u044b\u0434\u0430\u043b\u0441\u044f.\n\n@tomhunter", "creation_timestamp": "2021-12-23T17:49:44.000000Z"}, {"uuid": "a312336e-b87f-4bab-812e-eb999ee20b38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44790", "type": "exploited", "source": "https://www.exploit-db.com/exploits/51193", "content": "", "creation_timestamp": "2023-04-01T00:00:00.000000Z"}, {"uuid": "fe954e85-6ad5-412e-a118-d4491dbb8b79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44790", "type": "seen", "source": "Telegram/Hf_SunJuoYNf_bsQCJ20cuXyI7bzH8EMEXzusn30k3vpXeQ", "content": "", "creation_timestamp": "2024-10-15T10:14:15.000000Z"}, {"uuid": "0dee57d8-0201-414f-8bd8-d7e4d6fd4557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44790", "type": "seen", "source": "https://t.me/arpsyndicate/1472", "content": "#ExploitObserverAlert\n\nCVE-2021-44790\n\nDESCRIPTION: Exploit Observer has 39 entries related to CVE-2021-44790. A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.\n\nFIRST-EPSS: 0.060470000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-12-06T00:09:00.000000Z"}, {"uuid": "3ca3dd5b-0f34-4348-b7f3-fbb62fa95224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44790", "type": "seen", "source": "Telegram/EGF3NmaXYAGdUVCW6ZNHpq65TpVvAZPt5jTlYHUdXoaBYbM", "content": "", "creation_timestamp": "2022-03-04T19:45:45.000000Z"}, {"uuid": "77b55683-b8cd-4c09-8a25-471e21b33e07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-44790", "type": "published-proof-of-concept", "source": "Telegram/vDa6DsGy0Kv0j_L2mpgiLKo8rV0TFojx-ZaJHjxUdstlbRo1", "content": "", "creation_timestamp": "2022-01-25T20:42:22.000000Z"}]}