Debian DSA-6620-1: Apache HTTP Server 2.4.71 Patches Unauthenticated Code Execution and DoS — Patching and Detection Guide

---
title: Apache HTTP Server Spawning Shell or Interpreter
description: Detects the Apache worker process (www-data) spawning command shells, script interpreters, or download utilities — a strong indicator of web server RCE post-exploitation such as web shell deployment following exploitation of an unauthenticated Apache vulnerability (DSA-6620-1).
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6620-1-apache2
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/13
status: experimental
id: 3f8a2c71-9b4e-4d6a-b512-7c0e5f9a2d44
tags:
  - attack.execution
  - attack.t1059
  - attack.persistence
  - attack.t1505.003
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentCommandLine|contains:
      - '/usr/sbin/apache2'
      - '/usr/sbin/httpd'
    ParentUser: 'www-data'
  selection_child:
    CommandLine|contains:
      - '/bin/sh'
      - '/bin/bash'
      - '/bin/dash'
      - 'python'
      - 'perl'
      - 'curl '
      - 'wget '
      - 'nc '
      - 'ncat '
      - 'base64 -d'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate CGI applications and admin scripts executing under Apache — baseline known CGI handlers and exclude by full path
level: high
---
title: Suspicious File Write to Web-Accessible Directory by www-data
description: Detects the Apache service account writing executable or script files into web-accessible directories, consistent with web shell placement after exploitation of a remote code execution flaw in the Apache HTTP Server.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6620-1-apache2
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/13
status: experimental
id: 8d1e6b04-2c5f-4a78-9e31-5b7d4c8f1029
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: linux
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/htdocs/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.py'
      - '.pl'
      - '.sh'
      - '.jsp'
  selection_user:
    User: 'www-data'
  condition: selection_path and selection_ext and selection_user
falsepositives:
  - CMS auto-updates and plugin installers (e.g., WordPress) writing PHP files — correlate with change windows and known deployment pipelines
level: high
---
title: Outbound Connection from Apache Process to Rare External Host
description: Detects the Apache worker process initiating outbound network connections, which may indicate payload retrieval, reverse shell establishment, or data exfiltration following remote code execution. Baseline before deployment; legitimate reverse-proxy and API-calling applications will require tuning.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6620-1-apache2
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/02/13
status: experimental
id: b24c7f19-6e3a-4d08-a156-9f2e8b3c7061
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.exfiltration
logsource:
  product: linux
  category: network_connection
detection:
  selection:
    Image|endswith:
      - '/apache2'
      - '/httpd'
    Initiated: 'true'
  filter_local:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection and not filter_local
falsepositives:
  - Apache mod_proxy configurations, health checks, and applications making outbound API calls — restrict to hosts with no legitimate outbound web traffic
level: medium

// Hunt: Apache (www-data) spawning shells, interpreters, or download tools
// Relevant to post-exploitation of Apache HTTP Server RCE (Debian DSA-6620-1)
let lookback = 14d;
let suspicious_procs = dynamic(["/bin/sh", "/bin/bash", "/bin/dash", "curl", "wget", "nc", "ncat", "python", "perl", "base64"]);
Syslog
| where TimeGenerated > ago(lookback)
| where SyslogMessage has "www-data" or ProcessName has "apache2"
| where SyslogMessage has_any (suspicious_procs)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;
// Complementary hunt: flood patterns consistent with Apache DoS attempts (single source, high request volume, error responses)
CommonSecurityLog
| where TimeGenerated > ago(1d)
| where DestinationPort in (80, 443)
| summarize RequestCount = count(), ErrorCount = countif(ApplicationProtocol has "4" or ApplicationProtocol has "5") by SourceIP, DestinationHostName, bin(TimeGenerated, 5m)
| where RequestCount > 500
| order by RequestCount desc;

-- Artifact: SecurityArsenal.ApachePostCompromise
-- Hunts for Apache post-exploitation indicators: www-data child processes,
-- recently modified scripts in web roots, and outbound connections from apache2

-- 1) Processes running as www-data that should not be
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'www-data'
  AND (CommandLine =~ '(sh|bash|dash|python|perl|curl|wget|nc|ncat)'
       OR Exe =~ '/(tmp|dev/shm|var/tmp)/')

-- 2) Recently written script files in web roots (candidate web shells)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/var/www/**/*.php', '/var/www/**/*.phtml', '/var/www/**/*.sh', '/srv/www/**/*.php'])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

-- 3) Outbound network connections from Apache workers
SELECT Pid, Name, Family, Type, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Name =~ 'apache2'
  AND Status =~ 'ESTABLISHED'
  AND NOT RemoteAddr =~ '^(10\\.|172\\.16\\.|192\\.168\\.|127\\.)'

#!/bin/bash
# Security Arsenal - Apache DSA-6620-1 patch & verification script (Debian 13 trixie)
# Run as root. Review before executing in production.

set -euo pipefail

FIXED_VERSION="2.4.71-1~deb13u1"

echo "[+] Current apache2 package version:"
dpkg-query -W -f='${Version}\n' apache2 2>/dev/null || echo "apache2 not installed"

echo "[+] Current Apache binary version:"
apache2ctl -v 2>/dev/null || httpd -v 2>/dev/null || true

echo "[+] Refreshing package lists and applying apache2 security update..."
apt-get update
apt-get install --only-upgrade -y apache2 apache2-bin apache2-data apache2-utils

echo "[+] Verifying installed version meets or exceeds ${FIXED_VERSION}:"
INSTALLED=$(dpkg-query -W -f='${Version}' apache2)
echo "    Installed: ${INSTALLED}"
if dpkg --compare-versions "$INSTALLED" ge "$FIXED_VERSION"; then
  echo "[OK] apache2 is at or above the fixed version."
else
  echo "[FAIL] apache2 is still vulnerable — investigate apt pinning, held packages, or mirror sync lag."
  exit 1
fi

echo "[+] Restarting Apache to load patched binaries..."
apache2ctl configtest
systemctl restart apache2
systemctl is-active --quiet apache2 && echo "[OK] apache2 service is active."

echo "[+] Quick sweep: script files modified in web roots within the last 14 days (review for web shells):"
find /var/www /srv/www -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.sh' -o -name '*.pl' \) -mtime -14 2>/dev/null | head -50

echo "[+] Processes running as www-data (should be apache2 workers only):"
ps -u www-data -o pid,ppid,comm,args

echo "[+] Done. Review the sweep output above and hunt retroactively for the exposure window."