HTTP Response Splitting in Apache HTTP Server
Summary
CVE-2024-24795: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Affects apache2 across 2 version ranges.
< 2.4.59-r0
>= da5873e80d6eee7a0838793bf68f1d0254745fbb, < a751ae5cf6890cfd477f253390d09186386ea988
Fixed in 2.4.59-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software. It provides a reliable and efficient platform for hosting websites and applications. The server is known for its robustness, scalability, and extensive feature set. However, a vulnerability has been discovered in multiple modules of Apache HTTP Server that allows an attacker to inject malicious response headers into backend applications, leading to an HTTP desynchronization attack.
Vulnerability Detail
The vulnerability, identified as CVE-2024-24795, enables an attacker to manipulate the HTTP responses generated by the server. By injecting specially crafted response headers, the attacker can cause the HTTP protocol to become desynchronized, leading to various security implications. This could potentially allow the attacker to perform cross-site scripting (XSS) attacks, session hijacking, cache poisoning, or other forms of web application attacks. The impact of this vulnerability can be severe, compromising the integrity and confidentiality of user data.
How To Fix
Minimum fixed version
2.4.59-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to the fixed version of Apache HTTP Server.
Conclusion
The HTTP response splitting vulnerability in Apache HTTP Server can have severe consequences, potentially leading to various web application attacks. It is crucial to upgrade to the fixed version or apply the official patch to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server is an open-source web server software widely used for hosting websites and applications. It is known for its reliability, scalability, and extensive feature set.
HTTP response splitting is a vulnerability that allows an attacker to inject malicious response headers into backend applications, causing the HTTP protocol to become desynchronized.
This vulnerability can enable various attacks, including cross-site scripting (XSS), session hijacking, cache poisoning, and other web application attacks. It can compromise the integrity and confidentiality of user data.
To fix this vulnerability, it is recommended to upgrade to Apache HTTP Server version 2.4.59 or later, which includes a patch for the HTTP response splitting issue.
No, there is no known workaround for this vulnerability. Applying the official patch or upgrading to the fixed version is necessary.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
