CVE-2021-40438
mod_proxy SSRF
KEV RANSOMWARECRITICAL 9.0EPSS 100.0%
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
- Affected
- Apache Software Foundation · Apache HTTP Server
- CVSS v3.1 NVD
- 9.0 CRITICAL
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS v2.0 NVD
- 6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P - EPSS
- 100.00% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-12-01, used in ransomware campaigns
- Nuclei
- critical · CWE-918
- Published
- 2021-09-16
- Updated
- 2026-08-06
Proof-of-concept exploits (11)
- BabyTeam1024/CVE-2021-404382★ · 2021-10-28
- Cappricio-Securities/CVE-2021-404381★ · 2024-06-24
- Kashkovsky/CVE-2021-4043819★ · 2022-04-03
- ericmann/apache-cve-poc0★ · 2021-11-11
- gassara-kys/CVE-2021-404381★ · 2022-06-10
- pisut4152/Sigma-Rule-for-CVE-2021-40438-exploitation-attempt1★ · 2021-11-30
- sergiovks/CVE-2021-40438-Apache-2.4.48-SSRF-exploit10★ · 2023-12-12
- sixpacksecurity/CVE-2021-4043814★ · 2021-10-24
- vsh00t/BB-PoC0★ · 2021-11-22
- xiaojiangxl/CVE-2021-404385★ · 2021-10-18
- n0m-d/CVE-2021-40438-POC0★ · 2025-12-06
Nuclei templates (1)
Vulhub environments (1)
Exploit collections (2)
- apache-httpd-cve-2021-40438-ssrf.ymlchaitin/xray
- CVE-2021-40438.yamlzan8in/afrog
Security advisories
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf
- https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
- https://security.gentoo.org/glsa/202208-20
- https://security.netapp.com/advisory/ntap-20211008-0004
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-htt…
- https://www.debian.org/security/2021/dsa-4982
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.tenable.com/security/tns-2021-17
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/…