CVE-2024-38474·Apache vulnerability

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.60 or later to resolve a critical mod_rewrite substitution encoding vulnerability that could allow unauthorized script execution. If you use RewriteRules with unsafe character substitution, test your configuration after upgrading as the patch introduces stricter validation requiring the UnsafeAllow3F flag for previously permissive rules. Perform this update on all systems running Apache 2.4.0 through 2.4.59 as soon as possible given the critical severity.

sudo dnf update httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET requests containing URL-encoded or hex-encoded queries (\?|%3F) targeting paths outside web root directories, followed by successful execution indicated by 200 status codes and script output in response bodies instead of 403/404 errors

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement strict URL validation rules that block requests with suspicious percent-encoded or double-encoded query strings targeting script extensions (.php, .cgi, .py, .sh) on non-public directories; block requests attempting path traversal sequences like ../ or encoded variants; enforce whitelist-based RewriteRule filtering at the WAF layer until systems are patched

How to check if you are affected

1. Check installed Apache version: apache2ctl -v (Debian/Ubuntu) or httpd -v (RHEL/CentOS)
2. Review mod_rewrite configuration for unsafe RewriteRules: grep -r 'RewriteRule' /etc/apache2/conf-enabled/ or /etc/httpd/conf.d/
3. Search access logs for suspicious patterns targeting non-existent URLs followed by script execution: grep -E '(\?|%3F)' /var/log/apache2/access.log | grep -E '\.(php|cgi|py|sh)'
4. Verify patch installation by confirming version is 2.4.60 or higher: apache2ctl -v | grep -oP '\d+\.\d+\.\d+'

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• https://security.netapp.com/advisory/ntap-20240712-0001/
• http://www.openwall.com/lists/oss-security/2024/07/01/7
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://security.netapp.com/advisory/ntap-20240712-0001/