Critical Substitution Encoding Vulnerability in Apache HTTP Server 2.4.x
Summary
UBUNTU-CVE-2024-38474: Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclos... Affects apache2 versions < 2.4.7-1ubuntu4.22+esm10. Fixed in 2.4.7-1ubuntu4.22+esm10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely-used open-source web server software that enables the hosting of websites and applications. It is known for its flexibility, security features, and extensive support for various programming languages and modules. However, certain versions of Apache HTTP Server, specifically 2.4.59 and earlier, are vulnerable to a substitution encoding issue in the mod_rewrite module, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from a substitution encoding issue in the mod_rewrite module of Apache HTTP Server versions 2.4.59 and earlier. This flaw allows attackers to execute scripts in directories that are permitted by the server's configuration but are not directly accessible via any URL. Additionally, it can lead to the source disclosure of scripts that are intended to be executed only as CGI. The potential ramifications include unauthorized script execution and exposure of sensitive information, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
2.4.7-1ubuntu4.22+esm10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can specify the rewrite flag 'UnsafeAllow3F' in their RewriteRules to allow unsafe substitutions. However, this is not recommended as a long-term solution and should only be used until the server can be upgraded.
Conclusion
The substitution encoding vulnerability in Apache HTTP Server 2.4.59 and earlier poses significant security risks, allowing unauthorized script execution and potential information disclosure. Users are strongly advised to upgrade to version 2.4.60 or later to mitigate these risks effectively.
See every vulnerability recorded for apache2 →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Apache HTTP Server versions 2.4.59 and earlier are affected by this vulnerability.
The vulnerability can lead to unauthorized script execution and exposure of sensitive information, posing significant security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
