CVE-2024-38475

The mod_rewrite module incorrectly processes special characters during substitution in the server context, when the first segment of the substitution is a backreference or variable. This allows an attacker to construct a specially crafted URL that is mapped to a file system location accessible to the server but normally unreachable through any public URL. The consequence can be both source code disclosure and code execution on the server. The vendor introduced a new RewriteRule flag called 'UnsafePrefixStat', allowing administrators to restore the previous behavior after ensuring the security of the applied rules.

An attacker can gain unauthorized access to server system files (source code disclosure) or cause remote code execution (RCE) without the need for authentication.

Update Apache HTTP Server to a version higher than 2.4.59 as soon as possible, applying patches indicated by the vendor at https://httpd.apache.org/security/vulnerabilities_24.html. Administrators using unsafe RewriteRule rules should verify their correctness before any potential use of the 'UnsafePrefixStat' flag. For NetApp and SonicWall products, apply patches available from the vendor according to the references.

Apache HTTP Server versions 2.4.59 and earlier; dependent products: NetApp ONTAP 9, SonicWall SMA 200 Firmware, SonicWall SMA 200, SonicWall SMA 210 Firmware

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.