CVE-2024-38473·Apache vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 88% — in the top 0.5% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.60 or later to resolve an encoding bypass vulnerability in mod_proxy that could allow authenticated attackers to circumvent backend authentication mechanisms. Prioritize this update for any deployment where mod_proxy forwards requests to backend services, as the vulnerability requires valid credentials but can lead to authentication bypass on downstream systems.

sudo dnf update httpd && sudo systemctl restart httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET /[a-zA-Z0-9/_-]*%(?:2e|2f|5c|3a)[a-zA-Z0-9/_-]* HTTP/1\.[01].*X-Forwarded-For|Proxy-Authorization

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement a WAF rule to block HTTP requests to proxy endpoints (e.g., paths handled by mod_proxy) that contain URL-encoded special characters (%, hex-encoded octets) in the path segment, particularly %2e, %2f, %5c, and %3a, while allowing legitimate encoded parameters in query strings only.

How to check if you are affected

1. Run 'apache2ctl -v' or 'httpd -v' to check your current Apache version; if it reports 2.4.0 through 2.4.59, your installation is vulnerable
2. Execute 'apache2ctl -M | grep proxy' (or 'httpd -M | grep proxy' on RHEL/CentOS) to confirm mod_proxy is loaded; if it appears, the vulnerable component is active
3. Search your Apache access logs for requests containing URL-encoded characters followed by backend authentication failures: grep -i 'proxy.*%' /var/log/apache2/access.log | grep -i '401\|403'
4. After applying the patch, re-run 'apache2ctl -v' to confirm version 2.4.60 or later is installed, then verify mod_proxy still loads and test a backend proxy request completes without encoding anomalies

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• https://security.netapp.com/advisory/ntap-20240712-0001/
• http://www.openwall.com/lists/oss-security/2024/07/01/6
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://security.netapp.com/advisory/ntap-20240712-0001/