Apache HTTP Server

Where It Sits

The small stack marks its layer. Beside it, each related technology links to its own page.

About

Apache HTTP Server is one of the oldest and most common web servers. With mod_php, its PHP module, it runs PHP code in its own processes, the classic pairing behind WordPress. It can also sit in front of another server, such as Tomcat, and pass requests on. It usually runs on Linux.

How to Spot It

These are signs that a system runs Apache HTTP Server, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.

Response header

Server: Apache/2.4.58 (Ubuntu)

Page source

Apache2 Ubuntu Default Page

Default port

80 (HTTP) and 443 (HTTPS)

If It Has a Flaw

A flaw in Apache reaches every site it runs, and a misconfiguration can expose files well outside the web root, the folder it serves pages from. Where it only passes requests on, as to Tomcat, the traffic is at risk but not the code.

A flaw exposes what runs on it and the data it reaches.

Application

WordPress

Framework and Libraries

Laravel

Data

MySQL

A flaw puts the traffic it passes on at risk.

It passes requests on to these but never runs their code.

™Tomcat

Well-Known Flaws

Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Apache HTTP Server sits.

• CVE-2021-41773 (opens in a new tab)2021

  Path Traversal

  In Apache 2.4.49, this flaw could expose unprotected files and, with CGI enabled, run code.

  Reach It reached files outside the web root on every site the server hosted.

Rivals

Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach Apache HTTP Server.

• IIS
• nginx
• ™Tomcat

Stacks and Code

Apache HTTP Server is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.

In Common Stacks

WordPress on Linux, Apache, MySQL and PHP

Its Code Comes From

OS Packages

Sources

• Apache HTTP Server documentation (opens in a new tab)