CVE-2026-29170

Executive Summary

CVE-2026-29170 is a reflected cross-site scripting (XSS) vulnerability in the mod_proxy_ftp module of Apache HTTP Server versions 2.4.67 and earlier. The flaw exists in the HTML directory listing generation when the server is configured as a forward or reverse proxy for FTP resources. An attacker can inject arbitrary JavaScript into the generated directory listing page, which executes in the context of the victim's browser when they visit the maliciously crafted URL. This can lead to session hijacking, credential theft, or defacement. The vulnerability is unpatched in versions prior to 2.4.68, and no public exploit code or proof-of-concept is currently available. The EPSS score is 0.0%, indicating low exploitation activity at this time, but the risk increases as details become public.

Supply Chain & Package Security

This vulnerability affects the Apache HTTP Server, a core component of many web infrastructure stacks. Organizations using Apache as a reverse proxy for FTP services are directly impacted. The fix is available in version 2.4.68, which should be applied immediately. No known supply chain attacks leveraging this CVE have been reported, but the risk of malicious actors incorporating it into exploit kits is moderate.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited content manipulation
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction and is limited to reflected XSS, but it can be chained with other attacks to increase impact.

Deep Dive & Mechanics

The mod_proxy_ftp module in Apache HTTP Server generates HTML directory listings when proxying FTP resources. The vulnerability arises because the module does not properly sanitize FTP directory names or file names before embedding them into the HTML output. An attacker can craft a malicious FTP URL containing JavaScript payloads in the path or filename. When Apache generates the directory listing for that FTP resource, the payload is reflected in the HTML response without proper encoding, leading to XSS.

Root Cause: Insufficient output encoding of FTP directory/file names in the HTML listing generation code.

Attack Vector: The attacker sends a crafted request to the Apache server acting as a proxy for an FTP server. The request includes a malicious path or filename. The server fetches the FTP directory listing and generates an HTML page that includes the attacker-controlled string. The victim must visit this crafted URL (e.g., via phishing) for the XSS to trigger.

Impact: Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, potentially stealing session cookies, redirecting to malicious sites, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

The vulnerable code is in the mod_proxy_ftp.c file, specifically in the function that generates the HTML directory listing. The patch in version 2.4.68 adds proper HTML entity encoding for directory and file names.

Vulnerable Code (simplified):

// mod_proxy_ftp.c (vulnerable)
static int ftp_directory_listing(request_rec *r, const char *dir) {
    // ... fetch FTP listing ...
    ap_rprintf(r, "<a href=\"%s\">%s</a>\n", filename, filename);
    // filename is not escaped
}

Patched Code (simplified):

// mod_proxy_ftp.c (patched)
static int ftp_directory_listing(request_rec *r, const char *dir) {
    // ... fetch FTP listing ...
    char *escaped = ap_escape_html(r->pool, filename);
    ap_rprintf(r, "<a href=\"%s\">%s</a>\n", escaped, escaped);
    // filename is now escaped
}

The patch uses ap_escape_html() to encode HTML special characters like <, >, &, and " before output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Apache HTTP Server 2.4.67 or earlier with mod_proxy_ftp enabled.
• A target FTP server (can be a local test FTP server).
• The Apache server must be configured as a forward or reverse proxy for FTP.

Lab Setup:

1. Install Apache 2.4.67 on a test machine.
2. Enable mod_proxy and mod_proxy_ftp:

   LoadModule proxy_module modules/mod_proxy.so
   LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
   

3. Configure a reverse proxy for an FTP server:

   ProxyPass /ftp ftp://your-ftp-server/
   ProxyPassReverse /ftp ftp://your-ftp-server/
   

4. Restart Apache.

Exploitation Steps:

1. Craft a malicious URL that includes a JavaScript payload in the path:

   http://victim-apache/ftp/<script>alert('XSS')</script>/
   

2. Send this URL to a victim (e.g., via phishing email).
3. When the victim clicks the link, Apache fetches the FTP directory listing and generates an HTML page containing the script tag.
4. The JavaScript executes in the victim's browser.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor Apache access logs for requests containing <script> or other HTML tags in the URL path.
• Look for unusual patterns in FTP proxy requests, especially those with special characters.
• Use WAF rules to block requests with XSS payloads in the path.

Hunting:

• Search for mod_proxy_ftp usage in your environment.
• Review logs for requests to FTP proxy endpoints with suspicious characters.

Mitigation:

• Immediately upgrade to Apache 2.4.68.
• If upgrade is not possible, disable mod_proxy_ftp or restrict its use to trusted networks.
• Implement input validation and output encoding at the WAF level.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to Apache servers with FTP proxy paths containing <script>, onerror, javascript:, or other XSS payloads.
  • Unusual patterns in the URL path, such as /<script>alert(1)</script>/.
• Host IOCs:
  • Apache access logs showing requests with HTML tags in the URL.
  • Presence of mod_proxy_ftp in the Apache configuration.
• File IOCs:
  • No specific file IOCs; the vulnerability is in the module code itself.

Detection Engineering

YARA Rule

rule CVE_2026_29170_XSS_ProxyFTP {
    meta:
        description = "Detects XSS attempts targeting Apache mod_proxy_ftp"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-29170"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $ftp_proxy = "/ftp"
    condition:
        $ftp_proxy and $xss_payload
}

Sigma Rule

title: Apache mod_proxy_ftp XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS attacks against Apache mod_proxy_ftp
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '<script'
            - 'javascript:'
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of special characters in FTP paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-29170 Apache mod_proxy_ftp XSS Attempt"; flow:to_server,established; content:"/ftp"; http_uri; content:"<script"; http_uri; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Apache HTTP Server to version 2.4.68 or later.
2. If upgrade is not possible, disable mod_proxy_ftp:

   # Comment out or remove the LoadModule line
   # LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
   

3. Restrict FTP proxy usage to trusted internal networks only.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with XSS detection rules.
• Regularly update Apache and all modules.
• Conduct security reviews of proxy configurations.
• Monitor for new CVEs related to Apache modules.

Workaround:

• If mod_proxy_ftp is required, consider using a dedicated FTP proxy solution that is actively maintained.

Valters IT