CVE-2024-38474 Apache HTTP Server weakness with encoded question marks in backreferences
Attackers can execute scripts in restricted directories or disclose source code via encoded question marks in mod_rewrite rules.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38474?
CVE-2024-38474 is a high-severity path traversal vulnerability in Apache Http Server, published on 1 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
Weakness: CWE-116
Which versions are affected by CVE-2024-38474?
1 open source package ship an affected version, including apache. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.0 | 2.4.60 |
Products include Apache Http Server, Netapp Clustered Data Ontap.
How do I fix CVE-2024-38474?
Upgrade apache to 2.4.60 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-38474 being exploited?
There is no known exploitation of CVE-2024-38474 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2024-38474, BELL-CVE-2024-38474, BIT-apache-2024-38474, CLEANSTART-2026-RW47407, DEBIAN-CVE-2024-38474, GHSA-x6g9-g4wf-qrf7 and 3 more.