Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
CVE-2023-25690

9.8CRITICAL

Key Information:

Vendor
Apache
Status
Apache Http Server
Vendor
CVE Published:
7 March 2023

Badges

👾 Exploit Exists🟡 Public PoC

Summary

Certain configurations of the mod_proxy module in Apache HTTP Server versions 2.4.0 to 2.4.55 are susceptible to HTTP Request Smuggling attacks. This occurs when mod_proxy is enabled alongside certain RewriteRule or ProxyPassMatch configurations that improperly handle user-supplied request-target data. An attacker could exploit this flaw to bypass access controls, proxy unauthorized URLs, and potentially cause cache poisoning. It is crucial for users to upgrade to at least version 2.4.56 of Apache HTTP Server to mitigate these risks.

Affected Version(s)

Apache HTTP Server 2.4.0 <= 2.4.55

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-25690-POC
Created by dhmosfunk

linux-apache-fix-mod_rewrite-spaceInURL
Created by tbachvarova

CVE-2023-25690
Created by thanhlam-attt

References

https://httpd.apache.org/security/vulnerabilities_24.html
vendor-advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg0...
https://security.gentoo.org/glsa/202309-01

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lars Krapf of Adobe
.