CVE-2024-38476 Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect
Attackers can exploit malicious backend response headers to trigger local script execution, information disclosure, or SSRF in Apache HTTP Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38476?
CVE-2024-38476 is a critical code injection vulnerability in Apache Http Server, published on 1 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Weakness: CWE-829
Which versions are affected by CVE-2024-38476?
1 open source package ship an affected version, including apache. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.0 | 2.4.60 |
Linux distribution packages (39)
httpd AlmaLinux:8 | All versions | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
httpd-devel AlmaLinux:8 | All versions | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
httpd-filesystem AlmaLinux:8 | All versions | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
httpd-manual AlmaLinux:8 | All versions | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
httpd-tools AlmaLinux:8 | All versions | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
mod_http2 AlmaLinux:8 | All versions | 1.15.7-10.module_el8.10.0+3832+564e7653 |
mod_http2 AlmaLinux:8 | All versions | 1.15.7-10.module_el8.10.0+3872+9b8ab21e |
mod_ldap AlmaLinux:8 | All versions | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
mod_md AlmaLinux:8 | All versions | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa |
mod_md AlmaLinux:8 | All versions | 1:2.0.8-8.module_el8.6.0+3031+fb177b09 |
mod_proxy_html AlmaLinux:8 | All versions | 1:2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
mod_session AlmaLinux:8 | All versions | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
mod_ssl AlmaLinux:8 | All versions | 1:2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
httpd AlmaLinux:9 | All versions | 2.4.57-11.el9_4.1 |
httpd-core AlmaLinux:9 | All versions | 2.4.57-11.el9_4.1 |
httpd-devel AlmaLinux:9 | All versions | 2.4.57-11.el9_4.1 |
httpd-filesystem AlmaLinux:9 | All versions | 2.4.57-11.el9_4.1 |
httpd-manual AlmaLinux:9 | All versions | 2.4.57-11.el9_4.1 |
httpd-tools AlmaLinux:9 | All versions | 2.4.57-11.el9_4.1 |
mod_ldap AlmaLinux:9 | All versions | 2.4.57-11.el9_4.1 |
mod_lua AlmaLinux:9 | All versions | 2.4.57-11.el9_4.1 |
mod_proxy_html AlmaLinux:9 | All versions | 1:2.4.57-11.el9_4.1 |
mod_session AlmaLinux:9 | All versions | 2.4.57-11.el9_4.1 |
mod_ssl AlmaLinux:9 | All versions | 1:2.4.57-11.el9_4.1 |
httpd Red Hat:enterprise_linux:8::appstream | All versions | 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 |
httpd-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 |
httpd-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 |
httpd-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 |
httpd-filesystem Red Hat:enterprise_linux:8::appstream | All versions | 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 |
httpd-manual Red Hat:enterprise_linux:8::appstream | All versions | 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 |
httpd-tools Red Hat:enterprise_linux:8::appstream | All versions | 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 |
httpd-tools-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 |
mod_http2 Red Hat:enterprise_linux:8::appstream | All versions | 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 |
mod_http2-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 |
mod_http2-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 |
mod_ldap Red Hat:enterprise_linux:8::appstream | All versions | 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 |
mod_ldap-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.4.37-65.module+el8.10.0+22196+d82931da.2 |
mod_md Red Hat:enterprise_linux:8::appstream | All versions | 1:2.0.8-8.module+el8.9.0+19080+567b90f8 |
mod_md-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:2.0.8-8.module+el8.9.0+19080+567b90f8 |
Products include Apache Http Server, Netapp Clustered Data Ontap.
How do I fix CVE-2024-38476?
Upgrade apache to 2.4.60 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-38476 being exploited?
There is no known exploitation of CVE-2024-38476 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2024-38476, ALSA-2024:5138, ALSA-2024:5193, BELL-CVE-2024-38476, BIT-apache-2024-38476, CLEANSTART-2026-IB07435 and 17 more.