CVE-2024-38475·Apache vulnerability

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.60 or later immediately. If immediate upgrade is not possible, audit all RewriteRule directives in server context for backreferences or variables in the first segment of the substitution target.

sudo apt update && sudo apt install --only-upgrade apache2
# Verify: apache2 -v (should show 2.4.60+)
# Review rewrite rules:
grep -r RewriteRule /etc/apache2/sites-enabled/
sudo systemctl restart apache2

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET /rewrite-target/%2e%2e/%2e%2e/etc/passwd HTTP/1.1

Attackers craft URLs that exploit backreference substitution in RewriteRule to traverse outside the intended document root. Improper output escaping allows the resolved path to reference files outside the web root.

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

SecRule REQUEST_URI "(?:%2e%2e|%252e%252e|\.\.)" "id:20243847,phase:1,deny,status:403,msg:'CVE-2024-38475 path traversal via mod_rewrite',severity:CRITICAL"

How to check if you are affected

1. Check Apache version: apache2 -v or httpd -v — vulnerable if < 2.4.60
2. Audit RewriteRule directives using backreferences: grep -rn 'RewriteRule' /etc/apache2/ /etc/httpd/ 2>/dev/null
3. Check Apache access logs for path traversal: grep -iE '%2e%2e|%252e' /var/log/apache2/access.log
4. Verify mod_rewrite is loaded: apache2ctl -M | grep rewrite
5. Check error logs for unexpected file access: grep 'File does not exist' /var/log/apache2/error.log | grep -v 'favicon'

Indicators of compromise

• HTTP requests with encoded dot-dot sequences (%2e%2e) targeting rewrite endpoints
• Unexpected file reads in Apache error logs from outside document root
• Access to source files (.php, .conf) that should not be directly served
• Requests containing double-encoded path traversal (%252e%252e)

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• https://security.netapp.com/advisory/ntap-20240712-0001/
• http://www.openwall.com/lists/oss-security/2024/07/01/8
• https://github.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cf
• https://httpd.apache.org/security/vulnerabilities_24.html