Apache 2

Tenable plugin 170113 rolls up three flaws fixed in Apache HTTP Server 2.4.55 on January 17, 2023: CVE-2022-36760 in mod_proxy_ajp (request smuggling, affects 2.4.54 and earlier), CVE-2022-37436 in mod_proxy (response/header splitting triggered by a *malicious backend*, affects versions before 2.4.55), and CVE-2006-20001 in mod_dav (crafted If: header can crash the process, affects 2.4.54 and earlier). The plugin is version-only, so it fires on any host reporting Apache <2.4.55 whether or not mod_proxy_ajp, mod_proxy, or mod_dav are actually exposed in a reachable path.

The vendor labeling overshoots reality for most enterprises. The only pre-auth internet-relevant issue in the bundle is the AJP request-smuggling bug, and even that requires a fairly specific reverse-proxy design that many shops trimmed back after Ghostcat; the second issue assumes an already-malicious backend, and the third is mostly a crash bug gated by WebDAV usage. That makes critical a bad fleet-wide default and medium the right planning bucket unless you knowingly run internet-facing Apache reverse proxies to AJP backends.

Why this verdict

• Downward pressure: requires specific edge topology — CVE-2022-36760 only matters if Apache is both internet-reachable and actively proxying to AJP; that is a much smaller set than 'all Apache below 2.4.55'.
• Downward pressure: one flaw is post-compromise by design — CVE-2022-37436 needs a malicious or already-compromised backend, which implies the attacker is already deep in the chain.
• Downward pressure: one flaw is mostly availability-only — CVE-2006-20001 is tied to mod_dav and primarily crashes the process rather than handing over clean code execution.
• Downward pressure: no strong exploitation evidence — no KEV listing and no strong authoritative sign of widespread in-the-wild exploitation for this bundle.
• Not lower because edge proxies matter — if you do run exposed Apache-to-AJP reverse proxies, request smuggling on a trust boundary can produce meaningful security outcomes even without RCE.

Why not higher?

I am not keeping this at HIGH or CRITICAL because the plugin score is dominated by a request-smuggling CVE that assumes a specific, less-common deployment pattern. In real estates, each extra prerequisite compounds: internet exposure, Apache reverse proxy role, mod_proxy_ajp usage, and a backend path where desync has useful impact.

Why not lower?

I am not dropping this to LOW because Apache still sits on security boundaries, and request smuggling on boundary systems can punch above its weight when the topology matches. Also, large environments often have a few forgotten legacy reverse proxies where AJP or WebDAV stayed enabled longer than expected.

1. Inventory mod_proxy_ajp and mod_dav — Find the small subset of hosts where this bundle is *actually* reachable by checking loaded modules and vhost configs. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but do the inventory in the next normal review cycle so you can separate true exposure from scanner noise.
2. Retire AJP where possible — If you still proxy to Tomcat or similar backends over AJP, move to HTTP/S or strictly constrain that path to trusted internal links. There is no mitigation SLA for a MEDIUM verdict, but removing AJP is the single highest-value hardening move before the 365-day remediation deadline.
3. Disable unused WebDAV — Turn off mod_dav and DAV-enabled locations unless there is a documented business need. This strips out the CVE-2006-20001 path and should be handled during normal configuration hygiene before the remediation window closes.
4. Normalize and inspect edge traffic — Enforce strict request normalization on upstream load balancers/WAFs and alert on malformed or desync-style requests hitting Apache reverse proxies. This does not replace patching, but it raises attacker cost while you work through the MEDIUM bucket.

Run this on the target Linux host as a local auditor or through your config-management/EDR shell. Invoke it with sudo bash ./check_apache_2455_bundle.sh; root is recommended so the script can read package metadata, loaded modules, and Apache config paths. It prints VULNERABLE, PATCHED, or UNKNOWN and exits 1, 0, or 2 respectively.

#!/usr/bin/env bash
# check_apache_2455_bundle.sh
# Detect likely exposure to Tenable plugin 170113 / Apache httpd < 2.4.55 bundle
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

out() {
  echo "$1"
  exit "$2"
}

have() {
  command -v "$1" >/dev/null 2>&1
}

get_httpd_version() {
  local bin
  for bin in apache2 httpd /usr/sbin/apache2 /usr/sbin/httpd /usr/local/apache2/bin/httpd; do
    if [ -x "$bin" ]; then
      "$bin" -v 2>/dev/null | awk -F/ '/Server version/ {print $2}' | awk '{print $1}'
      return 0
    fi
  done
  return 1
}

ver_ge() {
  # semantic-ish compare for upstream Apache versions
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

check_modules_and_configs() {
  local mods=""
  local cfgs=""
  local bin

  for bin in apache2 httpd /usr/sbin/apache2 /usr/sbin/httpd /usr/local/apache2/bin/httpd; do
    if [ -x "$bin" ]; then
      mods="$($bin -M 2>/dev/null || true)"
      cfgs="$($bin -t -D DUMP_VHOSTS 2>/dev/null || true)"
      break
    fi
  done

  echo "$mods" | grep -qi 'proxy_ajp_module' && AJP_LOADED=1 || AJP_LOADED=0
  echo "$mods" | grep -qi 'dav_module' && DAV_LOADED=1 || DAV_LOADED=0
  echo "$mods" | grep -qi 'proxy_module' && PROXY_LOADED=1 || PROXY_LOADED=0
}

check_debian_ubuntu() {
  local pkgver osid codename fixed reason
  pkgver="$(dpkg-query -W -f='${Version}' apache2 2>/dev/null || true)"
  [ -n "$pkgver" ] || return 1

  osid=""
  codename=""
  if [ -r /etc/os-release ]; then
    . /etc/os-release
    osid="${ID:-}"
    codename="${VERSION_CODENAME:-}"
  fi

  if [ "$osid" = "ubuntu" ]; then
    case "$codename" in
      jammy) fixed='2.4.52-1ubuntu4.3' ;;
      focal) fixed='2.4.41-4ubuntu3.13' ;;
      bionic) fixed='2.4.29-1ubuntu4.26' ;;
      kinetic) fixed='2.4.54-2ubuntu1.1' ;;
      noble|oracular|plucky|questing|resolute) fixed='2.4.55-1ubuntu1' ;;
      *) fixed='' ;;
    esac
    if [ -n "$fixed" ]; then
      if dpkg --compare-versions "$pkgver" ge "$fixed"; then
        out "PATCHED" 0
      else
        check_modules_and_configs
        reason="package apache2=$pkgver is below Ubuntu fixed level $fixed"
        echo "$reason" >&2
        out "VULNERABLE" 1
      fi
    fi
  fi

  if [ "$osid" = "debian" ]; then
    case "${VERSION_ID:-}" in
      11) fixed='2.4.56-1~deb11u1' ;;
      12|13|14) fixed='2.4.55-1' ;;
      *) fixed='' ;;
    esac
    if [ -n "$fixed" ]; then
      if dpkg --compare-versions "$pkgver" ge "$fixed"; then
        out "PATCHED" 0
      else
        check_modules_and_configs
        reason="package apache2=$pkgver is below Debian fixed level $fixed"
        echo "$reason" >&2
        out "VULNERABLE" 1
      fi
    fi
  fi

  return 1
}

check_rpm_family() {
  local pkgver changelog upstream
  if ! have rpm; then
    return 1
  fi

  pkgver="$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' httpd 2>/dev/null || true)"
  [ -n "$pkgver" ] || return 1

  changelog="$(rpm -q --changelog httpd 2>/dev/null || true)"
  if echo "$changelog" | grep -q 'CVE-2022-36760' && \
     echo "$changelog" | grep -q 'CVE-2022-37436' && \
     echo "$changelog" | grep -q 'CVE-2006-20001'; then
    out "PATCHED" 0
  fi

  upstream="$(get_httpd_version || true)"
  if [ -n "$upstream" ] && ver_ge "$upstream" '2.4.55'; then
    out "PATCHED" 0
  fi

  echo "RPM package detected but no reliable backport evidence found in changelog; manual advisory check required" >&2
  out "UNKNOWN" 2
}

main() {
  local upstream

  check_debian_ubuntu || true
  check_rpm_family || true

  upstream="$(get_httpd_version || true)"
  if [ -z "$upstream" ]; then
    echo "Apache binary not found or version unreadable" >&2
    out "UNKNOWN" 2
  fi

  check_modules_and_configs

  if ver_ge "$upstream" '2.4.55'; then
    out "PATCHED" 0
  fi

  # For source-built or non-packaged Apache, upstream version is the best evidence available.
  echo "Apache reports upstream version $upstream (< 2.4.55)" >&2
  echo "Loaded modules: proxy=$PROXY_LOADED proxy_ajp=$AJP_LOADED dav=$DAV_LOADED" >&2
  out "VULNERABLE" 1
}

main "$@"

Sources

1. Tenable Nessus Plugin 170113
2. Apache HTTP Server 2.4 vulnerability history
3. OSV record for CVE-2022-36760
4. OSV record for CVE-2022-37436
5. OSV record for CVE-2006-20001
6. Ubuntu advisory for CVE-2022-37436
7. Debian OSV/backport record for CVE-2006-20001
8. CISA Known Exploited Vulnerabilities Catalog