CVE-2024-38474: Apache HTTP Server RCE Vulnerability

CVE-2024-38474 Overview

CVE-2024-38474 is a substitution encoding vulnerability in the mod_rewrite module of Apache HTTP Server versions 2.4.59 and earlier. This flaw allows remote attackers to execute scripts in directories that are permitted by the server configuration but not directly reachable by any URL. Additionally, attackers can exploit this vulnerability to achieve source disclosure of scripts that were intended to only be executed as CGI programs.

The vulnerability stems from improper encoding of substitutions in RewriteRules, which can be abused to bypass security restrictions and access protected resources. Organizations running affected versions of Apache HTTP Server should prioritize upgrading to version 2.4.60 or later, which addresses this issue.

Critical Impact

This vulnerability enables unauthorized script execution and source code disclosure on Apache HTTP Server installations, potentially leading to complete system compromise through network-based attacks requiring no authentication or user interaction.

Affected Products

• Apache HTTP Server versions up to and including 2.4.59
• NetApp Clustered Data ONTAP 9.0
• Any system utilizing vulnerable mod_rewrite configurations with unsafe capture and substitution patterns

Discovery Timeline

• 2024-07-01 - CVE-2024-38474 published to NVD
• 2025-03-25 - Last updated in NVD database

Technical Details for CVE-2024-38474

Vulnerability Analysis

This vulnerability is classified under CWE-116 (Improper Encoding or Escaping of Output). The core issue lies in how Apache HTTP Server's mod_rewrite module handles substitution encoding when processing RewriteRules that capture and substitute URL components.

When RewriteRules are configured to capture portions of a request URL and use those captured values in substitutions, the module fails to properly encode certain characters. This encoding flaw allows attackers to craft malicious requests that bypass intended access restrictions.

The practical impact is twofold: attackers can execute scripts located in directories that administrators intended to protect from direct URL access, and they can obtain the source code of CGI scripts that should only be executed rather than displayed. This source disclosure can reveal sensitive information such as database credentials, API keys, and application logic that could be leveraged for further attacks.

Root Cause

The root cause is improper output encoding in the mod_rewrite substitution handling logic. When RewriteRules capture user-controlled input and substitute it into new paths or URLs, the module does not adequately sanitize or encode special characters. This allows crafted input to manipulate the resulting path in ways that bypass directory restrictions and access control mechanisms.

Apache has addressed this by making RewriteRules that capture and substitute unsafely fail by default unless the new UnsafeAllow3F rewrite flag is explicitly specified, providing administrators explicit control over potentially dangerous configurations.

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker sends specially crafted HTTP requests to a vulnerable Apache HTTP Server with misconfigured RewriteRules. By manipulating URL components that are captured by RewriteRules, the attacker can inject encoded characters that, after improper substitution handling, result in access to restricted directories or script source files.

The attack requires no user interaction and can be automated, making it particularly dangerous for internet-facing web servers. Exploitation targets servers with RewriteRules that use backreferences from pattern matches in substitution strings without proper validation.

Detection Methods for CVE-2024-38474

Indicators of Compromise

• Unusual HTTP requests containing encoded characters targeting rewritten URLs
• Access log entries showing requests to paths that should not be directly reachable
• Unexpected file access patterns in directories containing CGI scripts
• Web server error logs showing rewrite processing anomalies

Detection Strategies

• Review Apache access logs for requests with suspicious URL encoding patterns, particularly those containing %3F sequences
• Monitor for unusual access patterns to CGI script directories that bypass normal URL routing
• Implement web application firewall rules to detect and block requests with malformed URL encodings targeting rewrite endpoints
• Audit RewriteRule configurations for patterns that capture and substitute user input without proper sanitization

Monitoring Recommendations

• Enable detailed Apache logging including mod_rewrite trace logging during investigation periods
• Configure SIEM alerts for anomalous access patterns to protected directories
• Monitor file access times on CGI scripts to detect unauthorized read operations
• Implement network-level monitoring for HTTP traffic patterns consistent with exploitation attempts

How to Mitigate CVE-2024-38474

Immediate Actions Required

• Upgrade Apache HTTP Server to version 2.4.60 or later immediately
• Audit all RewriteRule configurations for patterns that capture and substitute user-controlled input
• Review server configurations to ensure CGI scripts are properly protected from source disclosure
• Implement temporary access restrictions on sensitive directories until patching is complete

Patch Information

Apache has released version 2.4.60 which fixes this vulnerability. The update modifies the behavior of RewriteRules that capture and substitute potentially unsafe content, causing them to fail by default. Administrators who have reviewed their configurations and determined that unsafe substitutions are acceptable can use the new UnsafeAllow3F rewrite flag to maintain previous behavior.

For detailed information, refer to the Apache HTTP Server Security Vulnerabilities page. NetApp customers should consult the NetApp Security Advisory NTAP-20240712-0001 for guidance on affected ONTAP versions.

Workarounds

• Review and restrict RewriteRules that use backreferences in substitutions, particularly those handling user-controlled input
• Implement additional access controls at the directory level to prevent unauthorized script access
• Use a web application firewall to filter requests containing suspicious encoded characters
• Consider disabling mod_rewrite entirely if not required for application functionality

# Configuration example: Audit RewriteRules in Apache configuration
# Check for potentially vulnerable patterns in httpd.conf or .htaccess files

# Enable rewrite logging for investigation (Apache 2.4+)
LogLevel alert rewrite:trace3

# Example of restricting a directory that should not be directly accessible
<Directory "/var/www/protected-scripts">
    Require all denied
</Directory>

# After upgrading to 2.4.60, vulnerable rules will fail unless explicitly allowed
# Only add UnsafeAllow3F after thorough security review:
# RewriteRule ^(.*)$ /path/$1 [UnsafeAllow3F]