← back
CVE-2023-25690criticalobserved exploitationCWE-444

Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

97Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 9.8epss 85%
from disclosure to weapon49 days
Published on NVDMar 7
1st PoC+49d
VulnCheck+506d
exploitation probability
85%top 1% of all CVEs
observed exploitation
yesVulnCheck
9 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat JBoss Enterprise Application Platform 6
no_fix_planned: Out of support scope
Fixed
20 products (693 components)
Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream EUS (v.8.4) · Red Hat Enterprise Linux AppStream EUS (v.8.6) · Red Hat Enterprise Linux AppStream EUS (v.9.0) · and others 15
fix ↗
Not affected
3 products (103 components) — because the vulnerable code is not present in the product
Red Hat JBoss Core Services on RHEL 8 · Red Hat JBoss Core Services on RHEL 7 Server · Red Hat Enterprise Linux 6
In short

Apache HTTP Server can be tricked into sending malformed requests to backend servers when using certain rewrite or proxy rules. An attacker can exploit this to bypass security controls, access unintended content, or poison caches.

Technical detail

HTTP request smuggling vulnerability in Apache HTTP Server 2.4.0–2.4.55 occurring when mod_proxy is combined with mod_rewrite rules that match and reinject unsanitized user-supplied URL data into proxied requests. Attack vector requires attacker-controlled request-target input; exploitation can result in access control bypass, URL smuggling to origin servers, and cache poisoning.

Summary generated and translated by AI from the official description.
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache HTTP Server
public PoCs found — 9
githubgithub.com/dhmosfunk/CVE-2023-25690-POC★ 286githubgithub.com/thanhlam-attt/CVE-2023-25690★ 4githubgithub.com/oOCyginXOo/CVE-2023-25690-POC★ 2githubgithub.com/arnavps/CTF-Web-Exploitation★ 1githubgithub.com/tbachvarova/linux-apache-fix-mod_rewrite-spaceInURL★ 1vulncheckvulncheck.com/xdb/5b410372931funverifiedvulncheckvulncheck.com/xdb/760ecae2eb62unverifiedvulncheckvulncheck.com/xdb/60881b97bbc7unverifiedcve_referencepacketstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.htmlhttps://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.debian.org/debian-lts-announce/2023/04/msg00028.htmlhttps://security.gentoo.org/glsa/202309-01