Paper/Archive/CVE-2024-38475

CVE-2024-38475

Apache Software Foundation Apache HTTP Server — Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

KEV · due 22 May EPSS 100%public exploit SSVC act CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 In CISA KEV+3030.0 EPSS percentile 100.01.000 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

Affected

ProductAffectedFixed inSource

Apache HTTP Server2.4.0 – 2.4.59–CNA

http_server2.4.0 – 2.4.59–CISA-ADP

ontap_9all versions–CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisoryhttpd.apache.org/security/vulnerabilities_24.html refsecurity.netapp.com/advisory/ntap-20240712-0001 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475 refblackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227 refgithub.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cf refopenwall.com/lists/oss-security/2024/07/01/8 refpsirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018 kevcisa.gov/known-exploited-vulnerabilities-catalog