PRP: Request Apache HTTP Server Mod_Proxy SSRF vulnerability (CVE-2021-40438)

[timoles]

Hey Tsunami Team

I would like to contribute with a detector plugin for CVE-2021-40438 (SSRF in Apache HTTP Server Mod_Proxy <= 2.4.48)

• The vulnerability was discovered recently and a patched version is already available. - Yes, (Patched for Apache > v2.4.48) (A blogpost describing the vulnerability)
• The vulnerability should have a HIGH or CRITICAL severity rating if there is already a CVE ID assigned (CVSS score >= 7.0): CVSS Score: 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
• The vulnerability should have a relatively large impact radius. - Yes, widely used HTTP server
• The vulnerability should be remotely exploitable without authentication and user interaction. - Yes, unauthenticated attackers can exploit it.

Please note, I'm currently in the PR process of another detector, but that one should be near it's end (hopefully).

Please let me know if this is in scope and fine for me to develop.

[timoles]

Hey Tsunami Team

with #86 being wrapped up, would it possible to start the plugin process on this one?

Greetings