CVE-2024-39573·Apache vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 3.2% — higher than 87% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Apache HTTP Server 2.4.59 and earlier contain a flaw in mod_rewrite that can allow attackers to manipulate URL rewriting rules to route requests through mod_proxy unexpectedly, creating a server-side request forgery (SSRF) pathway. Upgrade to Apache 2.4.60 or later to resolve this vulnerability. Review your RewriteRules configuration to ensure they do not inadvertently enable proxy access to internal or restricted resources.

sudo dnf update httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET request containing encoded or unencoded rewrite rule parameters that include 'mod_proxy', '[P]' flag, or 'ProxyPassReverse' directives in the URI path or Host header, particularly targeting internal IP addresses or localhost endpoints

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement WAF rules to block HTTP requests containing rewrite rule syntax patterns in user input (e.g., regex patterns matching '\[P\]|ProxyPass|mod_proxy' in query strings and request headers). Additionally, restrict outbound proxy requests from the web application to only explicitly whitelisted internal endpoints.

How to check if you are affected

1. Step 1: Check your Apache version with 'apache2ctl -v' or 'httpd -v' and verify it is 2.4.60 or later
2. Step 2: Examine your Apache configuration files (typically /etc/apache2/apache2.conf or /etc/httpd/conf/httpd.conf) for RewriteRule directives that reference [P] proxy flag or RewriteCond rules that might route to mod_proxy
3. Step 3: Search Apache access and error logs for unusual proxy requests, particularly those targeting internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or localhost: 'grep -i "mod_proxy\|\[P\]" /var/log/apache2/access.log /var/log/apache2/error.log'
4. Step 4: After upgrading, confirm the new version with 'apache2ctl -v' or 'httpd -v' and restart the service: 'sudo systemctl restart apache2' or 'sudo systemctl restart httpd'

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• https://security.netapp.com/advisory/ntap-20240712-0001/
• http://seclists.org/fulldisclosure/2024/Oct/11
• http://www.openwall.com/lists/oss-security/2024/07/01/11
• https://httpd.apache.org/security/vulnerabilities_24.html