Unsafe RewriteRules Can Cause URL Redirection in Apache HTTP Server
CVE-2024-39573

7.5HIGH

Key Information:

Vendor
Apache
Status
Apache Http Server
Vendor
CVE Published:
1 July 2024

Summary

A potential Server-Side Request Forgery (SSRF) vulnerability exists in the mod_rewrite module of Apache HTTP Server versions up to 2.4.59. This flaw could allow an attacker to exploit unsafe RewriteRules, leading to unintended URL handling by the mod_proxy module. The issue can enable attackers to redirect requests in a manner that could be harmful to the server or the network. Users are strongly advised to upgrade to version 2.4.60 or later to mitigate this risk effectively.

Affected Version(s)

Apache HTTP Server 2.4.0 <= 2.4.59

References

https://httpd.apache.org/security/vulnerabilities_24.html
vendor-advisory
https://security.netapp.com/advisory/ntap-20240712-0001/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Orange Tsai (@orange_8361) from DEVCORE
.