Intel

CVE-2024-38475

Apache HTTP Server — Apache HTTP Server Improper Escaping of Output Vulnerability

criticalKEV: actively exploitedPoCEPSS 100%

Description

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

Source: BSI_CSAFBSIBSIBSI_CSAFCISA_KEVNVDCVEORGOSVCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2024-38475 carries a CVSS v3 score of 9.1 (AV:N/AC:L/PR:N/UI:N) and sits at the 100th EPSS percentile, meaning virtually every predictive model treats mass exploitation as imminent or already underway. The vulnerability allows an unauthenticated remote attacker to map arbitrary URLs to filesystem paths the server is permitted to serve but never intended to expose directly — in practice this translates to source code and credential disclosure, or remote code execution via reachable script endpoints. Organisations running internet-facing Apache httpd 2.4.59 or earlier, or the listed Oracle Communications products, must treat patch deployment as P1; Oracle products warrant particular urgency given their typically longer patch cycles. Although CISA has not flagged known ransomware campaign use, the combination of unauthenticated RCE potential and a maximum EPSS score is sufficient to classify this as critical in any NIS2-scoped environment and to mandate remediation within 24 hours.

Runbook · Step 1

Immediate response (0-24 h)

  • Upgrade Apache HTTP Server to version 2.4.60 or later — this is the vendor fix for CVE-2024-38475. Apply via OS package manager (apt upgrade apache2, yum update httpd) or download directly from apache.org/security/vulnerabilities_24.html.
  • For Oracle Communications products (versions 5.1, 5.2, 9, 15.0.0.0.0, 23.4.0, 23.4.4, 24.1.0, 24.2.0): check the Oracle Critical Patch Update for available patches and apply immediately — these products ship a vulnerable Apache httpd build.
  • Audit all RewriteRule directives in httpd.conf, .htaccess, and VirtualHost configs: any rule where the first segment of the substitution is a backreference ($1, %1) or variable (%{…}) defined in server context (not directory context) is potentially exploitable — disable or move such rules to directory context until patched.
  • Place any internet-facing Apache instances using mod_rewrite behind a WAF or reverse proxy with input validation if not already done.
  • Review the last 30 days of access logs for anomalous URL patterns (see Detection rules below) to identify prior or ongoing exploitation attempts.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move Apache servers that do not require direct internet exposure into an internal VLAN; restrict inbound HTTP/HTTPS traffic (TCP 80/443) to required source IP ranges.
  • WAF/IPS rule: Block or alert on requests containing path traversal sequences in the URL path: /../, %2f..%2f, %2e%2e, or unusual percent-encoding. Enable OWASP CRS ModSecurity rule 930110 (Path Traversal) and set Paranoia Level 2.
  • mod_rewrite hardening: Only set the UnsafePrefixStat flag if the substitution target is demonstrably constrained — otherwise remove it. Review all RewriteRules under least-privilege principles: substitution targets must not reference paths outside DocumentRoot.
  • Filesystem hardening: Ensure the Apache process user (www-data, apache) has read-only access limited to DocumentRoot and cannot access configuration files, scripts, or credentials outside the web root.
  • IAM/least privilege: Disable unused server-side scripts and CGI endpoints (Options -ExecCGI, Options -Indexes). Turn off directory listings to reduce source code disclosure risk.
  • Enhanced logging: Temporarily enable LogLevel rewrite:trace3 to log all RewriteRule evaluations and surface anomalous substitution paths — monitor log volume and apply only to affected systems.

Runbook · Step 3

Detection rules

  • Web server access log (Apache/Nginx): HTTP 200 responses to paths outside DocumentRoot or containing extensions such as .conf, .env, .php~, .bak, .key — SPL snippet: index=webserver sourcetype=access_combined (uri_path="*.conf" OR uri_path="*.env" OR uri_path="*.bak") status=200
  • URL path traversal patterns: Requests with encoded traversal sequences in the URI — Suricata rule idea: alert http any any -> $HTTP_SERVERS any (msg:"CVE-2024-38475 mod_rewrite path traversal attempt"; content:"%2e%2e"; http_uri; nocase; sid:2024384750; rev:1;) — also check for %2f, ..%2f, %252e.
  • Filesystem access outside DocumentRoot (auditd/Linux): Audit read access by the Apache process to paths outside /var/www or the configured DocumentRoot: -a always,exit -F arch=b64 -S open,openat -F uid=www-data -F path!=/var/www -k apache_traversal
  • Sysmon (Windows deployments): Event ID 11 (FileCreate) or Event ID 23 (FileDelete) by httpd.exe targeting paths outside the web root — KQL snippet: event.code:11 AND process.name:"httpd.exe" AND NOT file.path:*\\htdocs\\*
  • Anomalous HTTP response sizes: HTTP 200 responses with unusually large bodies on static resource URLs may indicate source code disclosure — monitor SIEM baseline deviations via avg(response_bytes) per URI class.

Metrics

Severity
critical
Priority score
215.11
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.1
Source: nvd-v3
CVSS v3
9.1
CVSS v4
—
EPSS percentile
100.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
100.0 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2025-05-01 00:00 UTC
CWE
CWE-116

Weakness classes (CWE)

  • CWE-116Class

    Improper Encoding or Escaping of Output

    The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

    cwe.mitre.org →

Affected operating systems

  • other

    sonicwall / sma_200_firmware

  • other

    sonicwall / sma_210_firmware

  • other

    sonicwall / sma_400_firmware

  • other

    sonicwall / sma_410_firmware

  • other

    sonicwall / sma_500v_firmware

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • bitnami

    apache2.4.0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2024-38475