CVE-2017-3167

What it actually does

Third-party modules calling ap_get_basic_auth_pw() outside the authentication phase can bypass configured authentication requirements on Apache httpd.

Why it matters to the business

Attackers may gain unauthorized access to protected web resources and data, increasing breach risk across any systems using the affected server software.

How an attack unfolds

An attacker identifies a vulnerable Apache httpd deployment and sends HTTP requests that trigger third-party modules to invoke the function outside its intended phase, thereby skipping authentication checks and reaching restricted content.

How to fix it

Upgrade Apache httpd to version 2.2.33 or 2.4.26 or later. Update mapproxy packages on Debian and Ubuntu to the listed fixed versions (1.10.4-1 or 1.11.0-1). Review all third-party modules to ensure they only call the function during authentication.

How to confirm the fix worked

Confirm the running httpd binary and module versions meet or exceed the fixed releases, then test that previously bypassable authentication-protected paths now enforce credentials.

Typical attack path

1. Scan for publicly reachable Apache httpd instances running versions before 2.2.33 or 2.4.26
2. Craft requests that invoke third-party modules using ap_get_basic_auth_pw() outside the authentication phase
3. Bypass authentication and access protected resources or perform further actions

How to detect it

Examine web server access and error logs for successful requests to authenticated paths that lack corresponding authentication records or contain unusual user-agent or request patterns.

What your security team should do

• Prioritize upgrade of all affected Apache httpd and mapproxy instances to the specified fixed versions
• Audit custom and third-party modules for misuse of ap_get_basic_auth_pw() outside authentication
• Implement compensating controls such as web application firewalls until patches are applied