Improper Encoding or Escaping of Output (CWE-116)
A substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL, or cause source disclosure of scripts meant to only be executed as CGI. This vulnerability is related to improper encoding or escaping of output.
This vulnerability could lead to unauthorized script execution in restricted directories or the disclosure of sensitive source code. Attackers could potentially exploit this to run malicious scripts or access confidential information, bypassing intended access restrictions. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical), with high impacts on confidentiality, integrity, and availability. It requires no privileges or user interaction and can be exploited over the network with low attack complexity. This indicates that the vulnerability is extremely severe and should be given high priority for patching.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Users are recommended to upgrade to Apache HTTP Server version 2.4.60, which fixes this issue.
Upgrade to Apache HTTP Server version 2.4.60. If immediate upgrading is not possible, review and adjust RewriteRules that capture and substitute unsafely. Note that some RewriteRules will now fail unless the rewrite flag "UnsafeAllow3F" is specified. Carefully evaluate the need for this flag, as it may reintroduce the vulnerability. Additionally, monitor for any suspicious activities related to script execution or unauthorized access to restricted directories.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2024-38474. See article
Feedly estimated the CVSS score as HIGH
This CVE started to trend in security discussions
NVD published the first details for CVE-2024-38474
RedHat CVE advisory released a security advisory (CVE-2024-38474).
Detection for the vulnerability has been added to Nessus (201198)
Detection for the vulnerability has been added to Qualys (513828)
The vulnerability CVE-2024-38474 in Apache HTTP Server allows for exploitation through encoded question marks in backreferences, posing a critical risk to affected systems. As of now, there are no known proof-of-concept exploits, but organizations should apply patches or mitigations provided by the vendor to prevent potential attacks. Downstream impacts to third-party vendors or technologies may occur if they rely on the vulnerable Apache HTTP Server version. See article
EPSS Score was set to: 0.04% (Percentile: 9.2%)