CVE-2024-38475

Apache HTTP Server Improper Escaping of Output Vulnerability

Apache HTTP Server

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change…

1. Jul 2024

Ausgewertete Quellen

• Hersteller
  https://httpd.apache.org/security/vulnerabilities_24.html
• Hinweis
  http://www.openwall.com/lists/oss-security/2024/07/01/8
• Hinweis
  https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018
• Hinweis
  https://security.netapp.com/advisory/ntap-20240712-0001/
• Hinweis
  https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475
• CISA
  Apache HTTP Server Improper Escaping of Output Vulnerability
• NVD
  CVE-2024-38475