critical CVSS 9.1 Actively exploited

CVE-2024-38475·Apache vulnerability

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

Severity
critical
Software
Apache
Fixed in
10.2.1.14-75sv
Published
2024-07-01

Affected versions

From: 2.4.0

Until: 10.2.1.14-75sv

Fixed in: 10.2.1.14-75sv

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.60 or later immediately. If immediate upgrade is not possible, audit all RewriteRule directives in server context for backreferences or variables in the first segment of the substitution target.

sudo apt update && sudo apt install --only-upgrade apache2
# Verify: apache2 -v (should show 2.4.60+)
# Review rewrite rules:
grep -r RewriteRule /etc/apache2/sites-enabled/
sudo systemctl restart apache2

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET /rewrite-target/%2e%2e/%2e%2e/etc/passwd HTTP/1.1

Attackers craft URLs that exploit backreference substitution in RewriteRule to traverse outside the intended document root. Improper output escaping allows the resolved path to reference files outside the web root.

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

SecRule REQUEST_URI "(?:%2e%2e|%252e%252e|\.\.)" "id:20243847,phase:1,deny,status:403,msg:'CVE-2024-38475 path traversal via mod_rewrite',severity:CRITICAL"

How to check if you are affected

  1. Check Apache version: apache2 -v or httpd -v — vulnerable if < 2.4.60
  2. Audit RewriteRule directives using backreferences: grep -rn 'RewriteRule' /etc/apache2/ /etc/httpd/ 2>/dev/null
  3. Check Apache access logs for path traversal: grep -iE '%2e%2e|%252e' /var/log/apache2/access.log
  4. Verify mod_rewrite is loaded: apache2ctl -M | grep rewrite
  5. Check error logs for unexpected file access: grep 'File does not exist' /var/log/apache2/error.log | grep -v 'favicon'

Indicators of compromise

  • HTTP requests with encoded dot-dot sequences (%2e%2e) targeting rewrite endpoints
  • Unexpected file reads in Apache error logs from outside document root
  • Access to source files (.php, .conf) that should not be directly served
  • Requests containing double-encoded path traversal (%252e%252e)

FAQ

Which Apache versions are affected?

All Apache HTTP Server versions from 2.4.0 through 2.4.59 are affected when mod_rewrite is enabled with backreference substitutions in server context. Version 2.4.60 contains the fix.

Is mod_rewrite enabled by default?

On most Linux distributions, mod_rewrite is installed but not always enabled by default. However, it is extremely common in production — virtually all WordPress, Laravel, and framework-based sites enable it.

Does this affect Apache behind a reverse proxy?

If the reverse proxy passes the raw URL through to Apache, yes. Some reverse proxies normalize URLs and strip traversal sequences, which may provide incidental protection, but do not rely on this.

Can this lead to remote code execution?

Yes. If the attacker can map to a CGI script, PHP file, or other executable resource outside the intended web root, they can achieve code execution. Source code disclosure is the more common impact, but RCE is possible depending on server configuration.

What is the UnsafePrefixStat flag?

Apache 2.4.60 introduced this rewrite flag to allow administrators to opt back into the old (vulnerable) behavior for specific rules. Using this flag re-introduces the vulnerability — only use it after carefully auditing the substitution target.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-38475. Free for 1 server.

Get started free