CVE-2024-38475
Apache HTTP Server Improper Escaping of Output Vulnerability
Description
CVE-2024-38475 is a critical improper output escaping vulnerability in the mod_rewrite module of Apache HTTP Server versions 2.4.59 and earlier. The flaw allows a remote unauthenticated attacker to map URLs to unintended filesystem locations, potentially achieving arbitrary code execution or source code disclosure on the server. With a CVSS v3.1 score of 9.1 and a severity rating of CRITICAL, this vulnerability poses a severe risk to any organization running affected Apache HTTP Server versions. CISA has added CVE-2024-38475 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 93.86% at the 99.86th percentile places it among the most actively exploited vulnerabilities in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | http server | >= 2.4.0, < 2.4.60 |
| netapp | ontap 9 | - |
| sonicwall | sma 200 firmware | < 10.2.1.14-75sv |
| sonicwall | sma 210 firmware | < 10.2.1.14-75sv |
| sonicwall | sma 400 firmware | < 10.2.1.14-75sv |
| sonicwall | sma 410 firmware | < 10.2.1.14-75sv |
| sonicwall | sma 500v firmware | < 10.2.1.14-75sv |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://httpd.apache.org/security/vulnerabilities_24.html(Vendor Advisory)
- https://security.netapp.com/advisory/ntap-20240712-0001/(Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2024/07/01/8(Third Party Advisory)
- https://github.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cf(Patch)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018(Third Party Advisory)
- https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475(Third Party Advisory, US Government Resource)
Weakness Type
CWE-116: Improper Encoding or Escaping of Output
CVE-2024-38475 is classified under CWE-116 (Improper Encoding or Escaping of Output), which describes a failure to properly encode or escape output before it is used in a downstream component. In the Apache HTTP Server's mod_rewrite module, substitution patterns that use backreferences or variables as the first segment are not properly escaped, allowing an attacker to craft URLs that resolve to filesystem paths outside the intended web root. This weakness enables the server to serve files that should not be directly accessible via any URL.
Learn more: CWE-116 — Improper Encoding or Escaping of Output
Impact Analysis
CVE-2024-38475 carries a CVSS v3.1 base score of 9.1 (CRITICAL), reflecting its devastating potential impact. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N), making it trivially exploitable by any attacker who can reach the server. Confidentiality (High): An attacker can access sensitive files on the filesystem, including application source code, configuration files containing credentials, and other protected resources that the server is permitted to serve but are not intended to be directly reachable. Integrity (High): The ability to map URLs to arbitrary filesystem locations can enable code execution, allowing attackers to modify server behavior, inject backdoors, or alter application logic. The availability impact is not rated as high in this case, but the combination of unauthorized file access and potential code execution makes this vulnerability extremely dangerous for any internet-facing Apache HTTP Server deployment. The EPSS score of 93.9% at the 99.9th percentile indicates near-certain exploitation activity, underscoring the urgency of immediate remediation.
Exploit Maturity
CVE-2024-38475 exhibits extremely high exploit maturity. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog, with a remediation deadline of May 22, 2025. The EPSS score of 93.9% at the 99.9th percentile indicates near-certain exploitation activity, placing it in the top tier of all tracked vulnerabilities for exploitation likelihood. The vulnerability was presented at Black Hat USA 2024 as part of research into confusion attacks exploiting hidden semantic ambiguity in Apache HTTP Server, and multiple vendors including SonicWall and NetApp have issued downstream advisories confirming their products are affected. The widespread deployment of Apache HTTP Server across the internet and the trivial nature of exploitation make this a high-priority threat requiring immediate action.
Remediation
-
Apply the vendor patch immediately. Upgrade Apache HTTP Server to version 2.4.60 or later, which addresses the improper output escaping in mod_rewrite. The official security advisory is available at httpd.apache.org.
-
Patch affected downstream products. SonicWall SMA 200/210/400/410/500v appliances running firmware below 10.2.1.14-75sv are vulnerable. Update to firmware 10.2.1.14-75sv or later. NetApp ONTAP 9 users should consult NetApp advisory ntap-20240712-0001.
-
Audit mod_rewrite configurations. Review all RewriteRule directives, especially those using backreferences or variables as the first segment of the substitution target. Ensure substitutions are appropriately constrained. If necessary, use the "UnsafePrefixStat" rewrite flag only after confirming the substitution is safe.
-
Implement network-level controls. Restrict access to the Apache HTTP Server to trusted IP ranges where possible. Deploy a Web Application Firewall (WAF) with rules to detect URL manipulation patterns targeting path traversal and filesystem mapping attacks.
-
Monitor for indicators of compromise. Review server access logs for unusual URL patterns, particularly those containing encoded characters or backreference-like patterns in request URIs that could indicate exploitation attempts.
Technical Details
CVE-2024-38475 is rooted in the mod_rewrite module of Apache HTTP Server, which performs URL-to-URL and URL-to-filesystem mapping based on regular expression rules. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N confirms this is a network-accessible vulnerability requiring no privileges or user interaction, with high impact on both confidentiality and integrity.
The flaw specifically affects RewriteRule substitutions in server context where a backreference (e.g., $1) or variable (e.g., %{REQUEST_URI}) is used as the first segment of the substitution string. When the mod_rewrite engine processes these substitutions, it fails to properly escape the output, allowing an attacker to craft a request URL that, after substitution, resolves to a filesystem path the server is configured to serve but that was never intended to be directly accessible via any URL. This can expose source code, configuration files, internal application data, and in certain configurations, enable arbitrary code execution through the server's file handling mechanisms.
The fix in Apache HTTP Server 2.4.60 introduces proper output escaping for mod_rewrite substitutions. Some previously functional but unsafe RewriteRule configurations may break after the update, and administrators can use the "UnsafePrefixStat" flag to restore the old behavior after verifying their rules are safe.
Frequently Asked Questions
Is CVE-2024-38475 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2024-38475 by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 93.86% at the 99.86th percentile indicates this is one of the most likely vulnerabilities to be exploited across all tracked CVEs.
What products are affected by CVE-2024-38475?
Apache HTTP Server versions 2.4.0 through 2.4.59 are directly affected. Additionally, SonicWall SMA 200/210/400/410/500v appliances (firmware < 10.2.1.14-75sv) and NetApp ONTAP 9 are confirmed as affected downstream products.
How do I fix CVE-2024-38475?
Upgrade Apache HTTP Server to version 2.4.60 or later. For SonicWall SMA appliances, update firmware to 10.2.1.14-75sv or later. Review and audit all mod_rewrite RewriteRule configurations, paying special attention to rules using backreferences or variables as the first substitution segment.
How severe is CVE-2024-38475?
With a CVSS v3.1 score of 9.1 (CRITICAL) and an EPSS score at the 99.86th percentile, CVE-2024-38475 is an extremely severe vulnerability. It allows unauthenticated remote attackers to access sensitive files and potentially execute code on affected servers with no user interaction required.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.