Apache HTTP Server 2.4.63 and Earlier: Insufficient Escaping Vulnerability in mod_ssl
Summary
ALPINE-CVE-2024-47252: Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. Affects apache2 versions < 2.4.64-r0. Fixed in 2.4.64-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache HTTP Server is a widely-used open-source web server software that enables users to serve web content. It is known for its flexibility, power, and extensive features, including support for various protocols and modules. The mod_ssl module provides SSL and TLS support for secure communications. However, versions 2.4.63 and earlier are vulnerable to an issue where user-supplied data is not properly escaped, potentially leading to security risks in logging configurations.
Vulnerability Detail
The vulnerability arises from insufficient escaping of user-supplied data in the mod_ssl module of Apache HTTP Server. This allows untrusted SSL/TLS clients to insert escape characters into log files, particularly when CustomLog is configured to log variables provided by mod_ssl, such as SSL_TLS_SNI. The lack of escaping means that unsanitized data can appear in log files, which may lead to information disclosure or log injection attacks.
How To Fix
Minimum fixed version
2.4.64-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider modifying your logging configuration to avoid using variables provided by mod_ssl in CustomLog directives until the update can be applied. For example, you can change the logging format to exclude '%{varname}x' or '%{varname}c'.
Conclusion
The insufficient escaping vulnerability in Apache HTTP Server versions 2.4.63 and earlier poses a significant risk by allowing untrusted client data to be logged unsanitized. It is crucial to update to the latest patched version to mitigate this risk and ensure secure logging practices.
See every vulnerability recorded for apache2 →
FAQ
The vulnerability can lead to unsanitized data appearing in log files, which may expose sensitive information or allow for log injection attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patch is available in version 2.4.64-r0 and later of Apache HTTP Server.
If immediate updating is not possible, consider modifying your logging configuration to avoid using vulnerable variables until you can apply the patch.
More information can be found in the CVE details for ALPINE-CVE-2024-47252 and through security advisories related to Apache HTTP Server.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
