CVE-2024-38474

The issue results from improper substitution encoding in RewriteRule rules of the mod_rewrite module. When rules capture and substitute input data in an unsafe manner, it is possible to construct a request that bypasses URL access restrictions and directs the server to execute a script located in a directly inaccessible directory, or disclose the contents of that script instead of executing it. The vulnerability can be exploited remotely, without authentication and user interaction. After applying the patch, RewriteRule rules performing unsafe substitutions will be rejected unless the 'UnsafeAllow3F' flag is explicitly set.

An attacker can remotely execute unauthorized CGI scripts in directories protected from direct URL access or gain access to the source code of these scripts, which may lead to disclosure of sensitive data (e.g., credentials, application logic) and compromise of system integrity and availability.

Apache HTTP Server should be updated to version 2.4.60, which eliminates this vulnerability. NetApp Clustered Data ONTAP users should apply patches according to the vendor advisory (ntap-20240712-0001). Additionally, existing RewriteRule rules should be reviewed for unsafe substitutions — rules requiring previous behavior must be marked with the 'UnsafeAllow3F' flag.

Apache HTTP Server version 2.4.59 and earlier; NetApp Clustered Data ONTAP (versions indicated in vendor references)