CVE-2023-25690 Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Attackers can smuggle HTTP requests to bypass access controls and poison caches in specific Apache mod_proxy configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25690?
CVE-2023-25690 is a critical vulnerability in Apache Http Server, published on 7 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.
Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like:
RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/
Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.
Weakness: CWE-444
Which versions are affected by CVE-2023-25690?
1 open source package ship an affected version, including apache. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.0 | 2.4.56 |
Linux distribution packages (39)
httpd AlmaLinux:8 | All versions | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 |
httpd-devel AlmaLinux:8 | All versions | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 |
httpd-filesystem AlmaLinux:8 | All versions | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 |
httpd-manual AlmaLinux:8 | All versions | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 |
httpd-tools AlmaLinux:8 | All versions | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 |
mod_http2 AlmaLinux:8 | All versions | 1.15.7-5.module_el8.7.0+3515+9e4fe0d6.4 |
mod_ldap AlmaLinux:8 | All versions | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 |
mod_md AlmaLinux:8 | All versions | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa |
mod_md AlmaLinux:8 | All versions | 1:2.0.8-8.module_el8.6.0+3031+fb177b09 |
mod_proxy_html AlmaLinux:8 | All versions | 1:2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 |
mod_session AlmaLinux:8 | All versions | 2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 |
mod_ssl AlmaLinux:8 | All versions | 1:2.4.37-51.module_el8.7.0+3515+9e4fe0d6.5 |
httpd AlmaLinux:9 | All versions | 2.4.53-7.el9_1.5 |
httpd-core AlmaLinux:9 | All versions | 2.4.53-7.el9_1.5 |
httpd-devel AlmaLinux:9 | All versions | 2.4.53-7.el9_1.5 |
httpd-filesystem AlmaLinux:9 | All versions | 2.4.53-7.el9_1.5 |
httpd-manual AlmaLinux:9 | All versions | 2.4.53-7.el9_1.5 |
httpd-tools AlmaLinux:9 | All versions | 2.4.53-7.el9_1.5 |
mod_http2 AlmaLinux:9 | All versions | 1.15.19-3.el9_1.5 |
mod_ldap AlmaLinux:9 | All versions | 2.4.53-7.el9_1.5 |
mod_lua AlmaLinux:9 | All versions | 2.4.53-7.el9_1.5 |
mod_proxy_html AlmaLinux:9 | All versions | 1:2.4.53-7.el9_1.5 |
mod_session AlmaLinux:9 | All versions | 2.4.53-7.el9_1.5 |
mod_ssl AlmaLinux:9 | All versions | 1:2.4.53-7.el9_1.5 |
httpd Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-98.el7_9.7 |
httpd-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-98.el7_9.7 |
httpd-devel Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-98.el7_9.7 |
httpd-manual Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-98.el7_9.7 |
httpd-tools Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-98.el7_9.7 |
mod_ldap Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-98.el7_9.7 |
mod_proxy_html Red Hat:enterprise_linux:7::client | All versions | 1:2.4.6-98.el7_9.7 |
mod_session Red Hat:enterprise_linux:7::client | All versions | 0:2.4.6-98.el7_9.7 |
mod_ssl Red Hat:enterprise_linux:7::client | All versions | 1:2.4.6-98.el7_9.7 |
httpd Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-98.el7_9.7 |
httpd-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-98.el7_9.7 |
httpd-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-98.el7_9.7 |
httpd-manual Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-98.el7_9.7 |
httpd-tools Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-98.el7_9.7 |
mod_ldap Red Hat:enterprise_linux:7::computenode | All versions | 0:2.4.6-98.el7_9.7 |
Products include Apache Http Server.
How do I fix CVE-2023-25690?
Upgrade apache to 2.4.56 or later.
Is CVE-2023-25690 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-25690 exists.
Public exploit code: 7 proofs of concept on GitHub.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2023-25690, ALSA-2023:1670, ALSA-2023:1673, AZL-25605, AZL-43903, AZL-45186 and 19 more.