CVE-2024-36387: Apache HTTP Server DoS Vulnerability

CVE-2024-36387 Overview

CVE-2024-36387 is a Null Pointer Dereference vulnerability in the Apache HTTP Server that occurs when serving WebSocket protocol upgrades over HTTP/2 connections. This flaw can result in a crash of the server process, leading to degraded performance and potential denial of service conditions.

Critical Impact

Attackers can trigger a server crash by sending specially crafted WebSocket upgrade requests over HTTP/2 connections, causing service disruption and degraded availability for legitimate users.

Affected Products

• Apache HTTP Server (versions affected as per vendor advisory)
• NetApp ONTAP 9

Discovery Timeline

• 2024-07-01 - CVE-2024-36387 published to NVD
• 2025-11-06 - Last updated in NVD database

Technical Details for CVE-2024-36387

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference) and affects the Apache HTTP Server's handling of WebSocket protocol upgrades when operating over HTTP/2 connections. When a client initiates a WebSocket upgrade request through an HTTP/2 connection, the server fails to properly validate certain internal pointers before dereferencing them. This results in accessing a null memory address, which immediately crashes the server process.

The attack requires network access and low privileges to execute, though no user interaction is necessary. While the vulnerability does not directly expose confidential data, it enables attackers to impact both the integrity and availability of affected systems through service disruption.

Root Cause

The root cause lies in improper input validation within the Apache HTTP Server's WebSocket upgrade handling code when processing HTTP/2 connections. The server does not adequately verify that necessary data structures are properly initialized before attempting to access them during the protocol upgrade process. When certain edge cases occur during the HTTP/2 to WebSocket transition, a pointer that should reference a valid memory structure instead contains a null value, and subsequent operations on this null pointer trigger a crash.

Attack Vector

The attack is network-based and can be executed remotely against any Apache HTTP Server instance that has both HTTP/2 and WebSocket support enabled. An attacker with low-level access to the server can craft malicious WebSocket upgrade requests specifically designed to trigger the null pointer condition. The attack does not require user interaction, making it particularly dangerous for public-facing web servers.

The exploitation involves sending a carefully constructed HTTP/2 connection with a WebSocket upgrade request that causes the server to enter a code path where pointer validation is insufficient. Repeated exploitation can result in sustained denial of service as the server process crashes and restarts.

Detection Methods for CVE-2024-36387

Indicators of Compromise

• Unexpected Apache HTTP Server process crashes or restarts in system logs
• Error log entries indicating segmentation faults or null pointer dereference conditions
• Increased frequency of HTTP/2 connections with WebSocket upgrade requests from unusual sources
• Service monitoring alerts for repeated httpd process terminations

Detection Strategies

• Monitor Apache error logs for crash-related entries, particularly those associated with mod_http2 or WebSocket handling modules
• Implement network traffic analysis to identify anomalous patterns of HTTP/2 WebSocket upgrade requests
• Deploy intrusion detection rules that flag rapid consecutive WebSocket upgrade attempts over HTTP/2
• Use application performance monitoring to detect sudden drops in server availability

Monitoring Recommendations

• Configure log aggregation to centralize Apache HTTP Server logs for crash pattern analysis
• Set up alerting thresholds for httpd process restart frequency
• Monitor HTTP/2 connection metrics for unusual upgrade request patterns
• Implement SentinelOne Singularity Platform for real-time process monitoring and crash detection

How to Mitigate CVE-2024-36387

Immediate Actions Required

• Update Apache HTTP Server to the latest patched version as specified in the vendor advisory
• Review server configurations to assess exposure if WebSocket over HTTP/2 is enabled
• Consider temporarily disabling WebSocket protocol upgrades over HTTP/2 if immediate patching is not possible
• Enable enhanced logging to capture potential exploitation attempts

Patch Information

Apache has released security patches addressing this vulnerability. Administrators should consult the Apache HTTP Security Vulnerabilities page for version-specific patch information and upgrade instructions. NetApp users should refer to the NetApp Security Advisory NTAP-20240712-0001 for guidance on ONTAP systems.

Workarounds

• Disable HTTP/2 protocol support temporarily by removing or commenting out the Protocols h2 h2c directives in the Apache configuration
• Disable WebSocket support if not required for application functionality
• Implement rate limiting on incoming connections to reduce the impact of potential exploitation attempts
• Use a reverse proxy or web application firewall to filter malicious WebSocket upgrade requests

# Temporary mitigation: Disable HTTP/2 in Apache configuration
# Edit /etc/httpd/conf/httpd.conf or equivalent

# Comment out or remove HTTP/2 protocol enablement:
# Protocols h2 h2c http/1.1

# Replace with HTTP/1.1 only:
Protocols http/1.1

# Restart Apache to apply changes
sudo systemctl restart httpd