CVE-2024-38475criticalunder attackCWE-116

CVE-2024-38475: critical vulnerability in Apache HTTP Server

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Published · Updated

Follow this CVE+ Monitor Apache HTTP Server+ Monitor apache2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.1epss 100%
from disclosure to weapon48 days
Published on NVDJul 1
1st PoC+48d
CISA KEV+304d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
19 products (749 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream E4S (v.8.6) · Red Hat Enterprise Linux AppStream EUS (v.8.8) · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux AppStream EUS (v.9.2) · and others 14
fix ↗
Not affected
2 products (18 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6
Action required by CISAfederal deadline: 2025-05-22

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Apache HTTP Server's mod_rewrite module incorrectly handles URL rewriting when the first part of a rewrite rule uses backreferences or variables, allowing attackers to access files on the server that shouldn't be publicly reachable. This can lead to running malicious code or exposing sensitive source code.

Technical detail

A flaw in mod_rewrite's output escaping (CWE-116) in Apache HTTP Server 2.4.59 and earlier allows path traversal when substitution rules begin with backreferences or variables in server context. An attacker can craft requests matching the rewrite pattern to bypass intended access restrictions and reach arbitrary filesystem locations served by the web server, enabling remote code execution or information disclosure.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Apache Software Foundation · Apache HTTP Server
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache HTTP Server

In the same product, most dangerous first.

CVE-2021-40438CRITICALmod_proxy SSRFEPSS 100.0%KEVCVE-2021-41773HIGHPath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49EPSS 100.0%KEVCVE-2021-42013CRITICALPath Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)EPSS 100.0%KEVCVE-2021-44790—Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlierEPSS 96.8%CVE-2017-9798—CVE-2017-9798EPSS 94.7%CVE-2022-30522—mod_sed denial of serviceEPSS 89.9%