Quantum Secular Labs / Blog / Advisories
CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
CVE-2024-38475 is rated critical with a CVSS v3.1 base score of 9.1 and affects Apache HTTP Server, along with 6 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-05-01, which means exploitation in the wild has been observed.
Vulnerability description
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
Severity breakdown
CVSS v3.1 9.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
- Attack complexity: Low. No special conditions; the attack can be repeated reliably.
- Privileges required: None. No account or prior access is needed.
- User interaction: None. No action from any user is needed.
- Scope: Unchanged. Impact stays within the vulnerable component.
- Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
- Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
- Availability impact: None. No effect on availability.
Underlying weakness
CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected products
- Apache HTTP Server: from 2.4.0 before 2.4.60
- Netapp Ontap 9: all versions listed by NVD
- Sonicwall Sma 200 Firmware: before 10.2.1.14-75sv
- Sonicwall Sma 210 Firmware: before 10.2.1.14-75sv
- Sonicwall Sma 400 Firmware: before 10.2.1.14-75sv
- Sonicwall Sma 410 Firmware: before 10.2.1.14-75sv
- Sonicwall Sma 500v Firmware: before 10.2.1.14-75sv
References
- https://github.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cf
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://security.netapp.com/advisory/ntap-20240712-0001/
- http://www.openwall.com/lists/oss-security/2024/07/01/8
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018
- https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475