CriticalCVE-2024-38475

    Apache HTTP Server Improper Escaping of Output Vulnerability (CVE-2024-38475)

    Published In CISA KEV since Sources: BSI, SUSE, OSV, Debian, pwn.watch, CVE.org

    What is affected, what to do

    This vulnerability allows an attacker to achieve Remote-Code Execution (RCE) or source code disclosure due to improper escaping of output in mod_rewrite in Apache HTTP Server versions 2.4.59 and earlier. An attacker can map URLs to filesystem locations that the server is allowed to serve but are not directly reachable by any URL. The vulnerability is actively exploited and listed in the CISA KEV catalog. Affected products include all versions up to 2.4.59, including the Bitnami Apache implementation. Immediate patching to version 2.4.60 or later is strongly recommended to maintain security.

    The vulnerability is being actively exploited; treat it as a priority. Update http_server to version 2.4.60. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Apache HTTP Server lte 2.4.0..2.4.59

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.1

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    9.1

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: BSI, SUSE, OSV, Debian, pwn.watch, CVE.org

    99.96 %

    EPSS score

    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

    Source: FIRST EPSS, percentile 99.98

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    231.07 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.1 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.1
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    99.96 %
    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.98
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-116

    Response and mitigation

    Why act now?

    Prioritisation rationale

    The flaw is network-reachable without authentication, delivers both remote code execution and source-code disclosure, and lives inside the world's most widely deployed web server — hence the extremely high observed exploitation likelihood and the CISA KEV listing. Attackers typically weaponise it in opportunistic internet-wide scans to pivot into configurations, credentials, and phar-deserialisation chains for RCE; CISA records no specific ransomware attribution, but the vulnerability is well suited as an initial-access vector. For NIS2-scoped organisations with internet-facing Apache (portals, reverse proxies, SonicWall SMA appliances) treat this as patch-now; internal Apache servers running non-trivial RewriteRules follow immediately after, ranked by exposure.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Upgrade Apache HTTP Server to 2.4.60 or later (preferably the current 2.4.x release, since several follow-up CVEs have been fixed since 2.4.60). Check distribution backports for RHEL, Debian/Ubuntu and SUSE — vendor packages are available.
      • Patch SonicWall SMA 200/210/400/410/500v to firmware 10.2.1.14-75sv or newer; remove the appliance from the public internet if the patch window cannot be met immediately.
      • NetApp ONTAP 9: cross-check NetApp advisory NTAP-20240712-0001 and apply the supplied hotfixes; restrict affected ONTAP management services to the management VLAN until patched.
      • Grep every httpd.conf, .htaccess and vhost include for RewriteRule lines whose substitution starts with a backreference ($1, %1) or a variable — these are the exploitable patterns. Either prefix affected rules with a static path, or disable them temporarily.
      • After patching, test rewrite behaviour. Only re-enable rules that break with the fix by adding the [UnsafePrefixStat] flag, and only after confirming the substitution is tightly constrained (e.g. via RewriteCond on an allow-listed character class).
      • Retro-hunt the last 90 days of web access logs for URL-encoded separators and unusual file extensions (.php, .phar, .inc, .env); on hits, invoke incident response and rotate any credentials or API keys that live on the host.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: remove admin and management interfaces of Apache hosts from the public internet; where Apache acts as a reverse proxy, restrict upstream mappings to explicitly defined backend paths.
      • WAF / reverse-proxy rule: block requests containing URL-encoded path separators (%2f, %5c) or null-byte variants (%00) inside path segments, especially when they target typical backend file extensions (.php, .phar, .ini, .env, .git/).
      • RewriteRule hardening: wrap every rule with variable substitution in a RewriteCond that enforces a strict character class (^[a-zA-Z0-9_-]+$); minimise DocumentRoot and Alias surfaces.
      • Filesystem hardening: strip the Apache user's read access to anything that could leak if accidentally served — backup folders, .git, .svn, config/, shell scripts — via <Directory> blocks or POSIX permissions.
      • Enable mod_security with OWASP CRS at paranoia level 2; CRS v4 ships rules against path-traversal and local-file-inclusion patterns that catch this vulnerability class.
      • Least privilege on the application layer: run PHP-FPM pools with strict open_basedir and disable_functions to limit RCE blast radius; ensure the Apache process has read-only access to static content paths only.

    3. Runbook step 3

      Detection rules

      • Access-log pattern: look for requests with URL-encoded separators in the first path component against known rewrite targets. Splunk example: index=web sourcetype=access_combined uri_path="*%2f*" OR uri_path="*%5c*" | stats count by src_ip, uri_path.
      • Sigma shape (Apache): title: Apache mod_rewrite Path Confusion Attempt / detection: selection: cs-uri-stem|contains: ['%2f', '%2F', '%5c'] / condition: selection. Baseline first, whitelist legacy applications.
      • EDR/Sysmon: alert on process ancestry httpd or apache2 spawning sh, bash, python or perl outside known CGI paths. Sysmon EID 1 where ParentImage ends in httpd and Image is a shell is a high-severity signal.
      • Filesystem monitoring (auditd/osquery): read access by the Apache user to sensitive files outside DocumentRoot — /etc/passwd, /var/www/*/config.php, .env files. Auditd: -w /etc/ -p r -k apache_sensitive_read.
      • Zeek/Suricata: HTTP responses with content-type text/plain or application/octet-stream on URIs that normally serve dynamic content — indicator of source-code disclosure.
      • Retroactive hunt (KQL): W3CIISLog | where csUriStem contains "%2f" or csUriStem contains "%5c" | where scStatus == 200 | summarize count() by cIP, csUriStem.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

    Source: BSI WID Portal, BSI CSAF, suse_csaf, OSV (Open Source Vulnerabilities), Debian Security Advisories, pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    Apache Software FoundationApache HTTP Server
    • 2.4.0 – ≤ 2.4.59
    • —
    apachehttp_server
    • 2.4.0 – < 2.4.60
    • 2.4.60
    netappontap_9
    • —
    • —
    OracleCommunications
    • 24.2.0
    • 9.3.0
    • 24.1.1
    • 9.2.0
    • 23.4.4
    • 8.1
    • 5.2
    • 4.1.0
    • 24.2.1
    • 47.0.0.0.0
    • 9
    • 9.0.0.0.0
    • 15.0.0.0.0
    • 24.3.0
    • 5.1
    • 8.6.0.4.0
    • 24.2.3
    • 15
    • 24.1.0
    • 8
    • 12.11
    • 14
    • 23.4.0
    • 4.2.0
    • 8.2.3.0.0
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    Distribution and container packages (1)

    Downstream packages (e.g. Bitnami, Debian, Ubuntu, Red Hat). Versions refer to the distribution, not the vendor.

    Distribution and container packages
    Affected versionsFixed in
    bitnamiapache
    • 2.4.0
    • —

    Vendors and products

    Affected operating systems

    Affected operating systems
    Linuxdebianapache2bookworm
    Linuxdebianapache2bullseye
    Othersonicwallsma_200_firmware—
    Othersonicwallsma_210_firmware—
    Othersonicwallsma_400_firmware—
    Othersonicwallsma_410_firmware—
    Othersonicwallsma_500v_firmware—

    Weakness classes (CWE)

    • CWE-116Improper Encoding or Escaping of Output

      Class

      The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

      Entry at MITRE CWE-116

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    PoC-in-GitHub (nomi-sec)Myesve (opens in a new tab)github.comPoC (publicly reported)reported, not verified

    References & sources

    • httpd.apache.orgApache advisory: Apache HTTP Serverweb, Vendor advisory, Vendor advisory, pwn-watch
    • security.netapp.comadvisory/ntap-20240712-0001web, Third-party advisory
    • openwall.comlists/oss-security/2024/07/01/8web, Third-party advisory
    • github.comapache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cfweb, Patch
    • blackhat.comus-24/briefings/schedule/index.htmlweb, Third-party advisory
    • NVD (NIST)NVD: CVE-2024-38475web, pwn-watch
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475web, government-resource, Third-party advisory, US government resource
    • psirt.global.sonicwall.comvuln-detail/SNWLID-2024-0018web, Third-party advisory
    • pwn.watchpwn.watch: Apache HTTP Server: HTTP Server Improper Escaping of Output Vulnerabilitypwn-watch
    • cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2024-38475
    <a href="https://intel.neosec.eu/en/cve/CVE-2024-38475"><img src="https://intel.neosec.eu/badge/cve/CVE-2024-38475.svg?lang=en" alt="CVE-2024-38475 – NEOSEC Intel" height="20"></a>