<story><title>Apache web server bug grants root access on shared hosting environments</title><url>https://www.zdnet.com/article/apache-web-server-bug-grants-root-access-on-shared-hosting-environments/</url></story><parent_chain><item><author>josteink</author><text>&amp;gt; Because on most Unix systems Apache httpd runs under the root user, any threat actor who has planted a malicious CGI script on an Apache server can use CVE-2019-0211 to take over the underlying system running the Apache httpd process, and inherently control the entire machine.&lt;p&gt;Maybe I am conflating things or mixing something up, but I was under the impression that it only used root-privileges to obtain access to restricted ports and immediately afterwords lowered its privileges lever to something sane&amp;#x2F;non-risky.&lt;p&gt;And if that is how it operates, then this exploit should not be effective.&lt;p&gt;Is that wrong? Have I been misled?</text></item></parent_chain><comment><author>SEJeff</author><text>&amp;gt; Because on most Unix systems Apache httpd runs under the root user&lt;p&gt;This hasn&amp;#x27;t been true for what, 10+ years? Apache runs as user www-data on Ubuntu&amp;#x2F;Debian and as user httpd on Redhat &amp;#x2F; SUSE based distributions.&lt;p&gt;You&amp;#x27;re entirely right, but this is a bit of embellishment on the part of the exploit author (even though it is serious!)</text></comment>
<story><title>Apache web server bug grants root access on shared hosting environments</title><url>https://www.zdnet.com/article/apache-web-server-bug-grants-root-access-on-shared-hosting-environments/</url></story><parent_chain><item><author>josteink</author><text>&amp;gt; Because on most Unix systems Apache httpd runs under the root user, any threat actor who has planted a malicious CGI script on an Apache server can use CVE-2019-0211 to take over the underlying system running the Apache httpd process, and inherently control the entire machine.&lt;p&gt;Maybe I am conflating things or mixing something up, but I was under the impression that it only used root-privileges to obtain access to restricted ports and immediately afterwords lowered its privileges lever to something sane&amp;#x2F;non-risky.&lt;p&gt;And if that is how it operates, then this exploit should not be effective.&lt;p&gt;Is that wrong? Have I been misled?</text></item></parent_chain><comment><author>chrismeller</author><text>The worker processes that actually do all the rendering run as the user and group you’ve configured. The parent continues as root.</text></comment>