CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability

Published Jul 1, 2024
·
Updated

Apache HTTP Server contains an improper escaping of output vulnerability in modrewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.

Other sources

CVE-2024-38474 Substitution encoding issue in modrewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified. CVE-2024-38475 Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

— F5

Affected Software

21 affected componentsFixes available
debian/apache2
2.4.62-1~deb11u12.4.61-1~deb11u12.4.62-1~deb12u12.4.62-1~deb12u22.4.62-3
Apache HTTP Server
F5 BIG-IP>=17.1.0<=17.1.2
17.5.017.1.2.2
F5 BIG-IP>=16.1.0<=16.1.5
16.1.6
F5 BIG-IP>=15.1.0<=15.1.10
F5 Traffix SDC=5.2.0, =5.1.0
IBM R10.0<=10.1.3.0 10.0.245.0
IBM R9.4<=89.42.18.0 89.41.25.0 89.40.83.0
IBM R9.3<=89.33.52.0 89.33.45.0
Apache HTTP Server>=2.4.0<2.4.60
NetApp Ontap 9
All of the following
SonicWall Sma 200 Firmware<10.2.1.14-75sv
SonicWall SMA 200
All of the following
SonicWall Sma 210 Firmware<10.2.1.14-75sv
SonicWall Sma 210
All of the following
SonicWall Sma 400 Firmware<10.2.1.14-75sv
SonicWall Sma 400
All of the following
SonicWall Sma 410 Firmware<10.2.1.14-75sv
SonicWall Sma 410
All of the following
SonicWall Sma 500v Firmware<10.2.1.14-75sv
SonicWall Sma 500v

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/apache2 to a version that resolves this vulnerability.

    Fixed in 2.4.62-1~deb11u1Fixed in 2.4.61-1~deb11u1Fixed in 2.4.62-1~deb12u1Fixed in 2.4.62-1~deb12u2Fixed in 2.4.62-3
  2. Upgrade

    Upgrade F5 BIG-IP and BIG-IQ Centralized Management to a version that resolves this vulnerability.

    Fixed in 17.5.017.1.2.2
  3. Upgrade

    Upgrade F5 BIG-IP and BIG-IQ Centralized Management to a version that resolves this vulnerability.

    Fixed in 16.1.6
  4. Upgrade

    Upgrade Apache HTTP Server to a version that resolves this vulnerability.

    Fixed in 2.4.60
  5. Upgrade

    Upgrade debian/apache2 to a version that resolves this vulnerability.

    Fixed in 2.4.62-1~deb11u1
  6. Upgrade

    Upgrade debian/apache2 to a version that resolves this vulnerability.

    Fixed in 2.4.61-1~deb11u1
  7. Upgrade

    Upgrade debian/apache2 to a version that resolves this vulnerability.

    Fixed in 2.4.62-1~deb12u1
  8. Upgrade

    Upgrade debian/apache2 to a version that resolves this vulnerability.

    Fixed in 2.4.62-1~deb12u2
  9. Upgrade

    Upgrade debian/apache2 to a version that resolves this vulnerability.

    Fixed in 2.4.62-3
  10. Configuration

    If a RewriteRule that previously relied on unsafe substitution must continue to work, add the UnsafeAllow3F flag to the RewriteRule only after ensuring the substitution is safely constrained.

    Apache HTTP Server (mod_rewrite) RewriteRule flag UnsafeAllow3F = enable/use when needed
  11. Configuration

    If substitutions in server context that use backreferences or variables as the first segment must be allowed, add the UnsafePrefixStat flag to opt back in only after ensuring the substitution is appropriately constrained.

    Apache HTTP Server (mod_rewrite) RewriteRule flag UnsafePrefixStat = enable/use when needed
  12. Compensating control

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Event History

Jul 1, 2024
CVE Published
via MITRE·06:15 PM
Data Sourced
via MITRE·06:15 PM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·07:22 PM
DescriptionSeverityAffected Software
Aug 8, 2024
Advisory Published
via F5·04:56 AM
Sep 18, 2024
Data Sourced
via Ubuntu·06:40 PM
RemedyDescriptionSeverityAffected Software
Apr 30, 2025
News Published
via BleepingComputer·05:23 PM
News Published
via BleepingComputer·05:25 PM
May 1, 2025
Known Exploited
via CISA·12:00 AM
May 8, 2025
News Published
via BleepingComputer·11:19 AM
Jul 16, 2025
News Published
via The Register·02:00 PM
News Published
via The Register·02:03 PM
News Published
via BleepingComputer·03:33 PM
Jul 24, 2025
News Published
via BleepingComputer·11:17 AM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-38475?

CVE-2024-38475 has a high severity rating due to its potential to allow unauthorized script execution.

2

How do I fix CVE-2024-38475?

To fix CVE-2024-38475, update to the patched versions of Apache HTTP Server 2.4.62 or later.

3

What versions of Apache HTTP Server are affected by CVE-2024-38475?

CVE-2024-38475 affects Apache HTTP Server versions 2.4.59 and earlier.

4

What products other than Apache are impacted by CVE-2024-38475?

CVE-2024-38475 also affects IBM Planning Analytics and specific versions of F5 BIG-IP and Traffix Systems.

5

Can CVE-2024-38475 lead to data leakage?

Yes, CVE-2024-38475 can allow disclosure of scripts that should only be executed as server-side processes.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203