LiveActive security incident?Get immediate response
CVE Record

CVE-2021-40438: mod_proxy SSRF

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CriticalCVSS 9Known exploitedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A remote, unauthenticated attacker can manipulate an affected Apache web server into sending requests to attacker-selected systems. This may expose internal services or enable harmful actions through the server’s trusted network position. Internet-facing proxy servers warrant urgent attention.

Executive priority

Treat as an urgent remediation item because exploitation is documented and successful abuse could cross network trust boundaries. Patch exposed proxy servers first, investigate suspicious outbound activity, and require confirmation that affected versions have been removed or isolated.

Technical view

CVE-2021-40438 is a server-side request forgery flaw in mod_proxy affecting Apache HTTP Server 2.4.48 and earlier. A crafted URI path can redirect proxy forwarding to an attacker-chosen origin. CVSS 3.1 scores it 9.0, with high confidentiality, integrity, and availability impact despite high attack complexity.

Likely exposure

Exposure is most likely where Apache HTTP Server 2.4.48 or earlier uses mod_proxy and accepts untrusted remote requests. Internet accessibility and access from the proxy host to sensitive internal services increase risk. The bundle does not establish that every installation is exploitable.

Exploitation context

CISA lists CVE-2021-40438 in its Known Exploited Vulnerabilities catalog, supporting active exploitation in the wild. The supplied evidence does not identify current campaigns, exploitation volume, targeted sectors, or specific attacker behavior.

Researcher notes

The weakness maps to CWE-918. Its defining behavior is attacker influence over the proxy’s chosen origin through a crafted URI path. Assessment should consider configuration and reachable destinations, not version alone. The supplied sources provide no campaign-level indicators or evidence that all mod_proxy configurations are vulnerable.

Mitigation direction

  • Upgrade affected servers to Apache HTTP Server 2.4.49 or a later supported vendor-fixed release.
  • Apply the appropriate distribution or appliance vendor security update where Apache is bundled.
  • Restrict unnecessary proxy functionality and limit the server’s outbound access to sensitive destinations.
  • Prioritize Internet-facing systems and follow current Apache or downstream vendor guidance.

Validation and detection

  • Inventory Apache HTTP Server versions and identify systems running 2.4.48 or earlier.
  • Confirm whether mod_proxy is loaded and which externally reachable routes invoke proxy behavior.
  • Review proxy and network logs for requests or connections involving unexpected destinations.
  • Verify patched package versions against Apache or the relevant distribution vendor advisory.
  • Confirm outbound controls prevent proxy hosts from reaching unnecessary internal services.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-918: Information exposure and cloud metadata lookup

Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Cloud metadata behavior lookup

The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-40438 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9 (3.1)
Known Exploited
Yes
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
2ADP providers
21Source links

CISA KEV status

Status
Known exploited
Source
CISA-ADP
Date added
KEV reference

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: activeAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9CVSS 3.1CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H2.26CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

9Critical
CVSS 3.1 vector shape for CVE-2021-40438Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. Source timelineapache

    2.4.49 released

  3. CVE publishedCVE Program

    The CVE record was published.

  4. Added to KEVCISA-ADP

    CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvcother:kev

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Apache Software FoundationApache HTTP ServerApache HTTP Server 2.4Listed
Weakness

CWE details

CWE-918

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-918 · source CWE mapping

Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs