Code Execution or Source Code Disclosure Vulnerability in Apache HTTP Server's mod_rewrite
CVE-2024-38475

9.1CRITICAL

Key Information:

Vendor
Apache
Status
Apache Http Server
Vendor
CVE Published:
1 July 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The vulnerability arises from improper escaping of output in the mod_rewrite module of Apache HTTP Server versions 2.4.59 and earlier. This flaw allows attackers to manipulate URL mappings, potentially leading to unauthorized access to filesystem locations. These locations, while permitted for server access, should not be directly reachable via web URLs, which poses a risk for code execution or disclosure of sensitive source code. The issue particularly affects substitutions that use backreferences or variables in the initial segment of the substitutions. Administrators are advised to review their RewriteRules, as some could be rendered unsafe due to this vulnerability. While the rewrite flag 'UnsafePrefixStat' can be employed to revert to the prior unsafe behavior, it is crucial to ensure that restrictions are adequately imposed on substitutions to maintain security.

Affected Version(s)

Apache HTTP Server 2.4.0 <= 2.4.59

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-38475
Created by soltanali0

References

https://httpd.apache.org/security/vulnerabilities_24.html
vendor-advisory
https://security.netapp.com/advisory/ntap-20240712-0001/

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Orange Tsai (@orange_8361) from DEVCORE
.