Listen to this Post
The vulnerability CVE-2025-66200 is a security bypass in Apache HTTP Server affecting versions 2.4.7 through 2.4.65. It occurs in a specific configuration where the `mod_userdir` module is used alongside the `suexec` mechanism for executing CGI scripts. The core flaw is an improper interaction between the `AllowOverride FileInfo` directive and the `RequestHeader` directive. When `AllowOverride FileInfo` is enabled, users with write access to an `.htaccess` file within their user directory can inject a `RequestHeader` directive. This injected header can manipulate the server’s internal processing, tricking it into misidentifying the correct user associated with a CGI script request. Consequently, the `suexec` wrapper, which is designed to run scripts under the file owner’s privileges, executes the script with an incorrect and potentially more privileged user ID, leading to a local privilege escalation.
dailycve form:
Platform: Apache HTTP Server
Version: 2.4.7-2.4.65
Vulnerability: Suexec bypass
Severity: Medium (CVSS 5.4)
date: 2025-12-05
Prediction: Patched 2025-12-04
What Undercode Say:
Analytics:
httpd -v apachectl -v grep -r "AllowOverride FileInfo" /etc/apache2/ grep -r "mod_userdir" /etc/apache2/
How Exploit:
An attacker with local shell access and the ability to write an `.htaccess` file in a `mod_userdir` directory (e.g., ~/public_html) can insert a `RequestHeader` directive. This directive modifies the request environment for CGI scripts, interfering with the user identification process performed by mod_userdir. When a CGI script in that directory is subsequently requested via a web browser, the `suexec` wrapper incorrectly assigns it the privileges of a different system user, as dictated by the forged request header.
Protection from this CVE:
Upgrade to Apache HTTP Server version 2.4.66. If immediate upgrade is not possible, mitigate risk by disabling the `AllowOverride FileInfo` directive for `mod_userdir` paths or by disabling `mod_userdir` entirely if it is not required. Restrict write access to directories where `.htaccess` files are permitted.
Impact:
Privilege escalation for local users. Unauthorized CGI script execution. Bypass of intended `suexec` security policy.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
