Critical Log Injection Vulnerability in Apache HTTP Server 2.4.63 and Earlier
Summary
CVE-2024-47252: Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. Affects apache2 across 2 version ranges.
< 2.4.64-r0
>= da5873e80d6eee7a0838793bf68f1d0254745fbb, < 7e926454793abd7d71b6afc8bd1ec1648752c6ad
Fixed in 2.4.64-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache, is a widely-used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, security features, and extensive support for various protocols. However, versions 2.4.63 and earlier are vulnerable to a critical issue in mod_ssl, which can lead to unsanitized user data being logged, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2024-47252, arises from insufficient escaping of user-supplied data in mod_ssl. This flaw allows an untrusted SSL/TLS client to insert escape characters into log files when specific logging configurations are used. In scenarios where CustomLog is configured with variables like '%{varname}x' or '%{varname}c', the lack of escaping means that unsanitized data from clients can be logged, leading to potential information disclosure and log injection attacks.
How To Fix
Minimum fixed version
2.4.64-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify your logging configuration to avoid using variables that are susceptible to this vulnerability. For instance, avoid using '%{varname}x' or '%{varname}c' in your CustomLog directives until the package is updated.
Conclusion
CVE-2024-47252 is a critical vulnerability in Apache HTTP Server that can lead to serious security risks due to improper handling of user-supplied data in logs. It is crucial to update to the patched version to mitigate these risks and ensure the security of your web applications.
See every vulnerability recorded for apache2 →
FAQ
CVE-2024-47252 is a vulnerability in Apache HTTP Server that allows untrusted SSL/TLS clients to inject escape characters into log files due to insufficient data escaping.
Apache HTTP Server versions 2.4.63 and earlier are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include information disclosure and log injection attacks, which can compromise the security of your application and expose sensitive data.
Yes, the patch is available in Apache HTTP Server version 2.4.64-r0 and later. It is recommended to update to this version or higher.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
