Vulnerability record · CVE-2024-38475 · published 1 July 2024
CVE-2024-38475: Apache HTTP Server mod_rewrite improper escaping enables code execution
Apache · Http Server
Apache HTTP Server 2.4.59 and earlier has an improper output escaping flaw in mod_rewrite. Substitutions in server context that use a backreference or variable as the first segment of the substitution can map URLs to filesystem locations that are served but not intentionally reachable by any URL. This can lead to code execution or source code disclosure.
Description
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Automated analysis
critical priorityCVSS 9.1, CISA KEV listing, and near-maximum EPSS probability indicate severe, actively exploited risk.
What it is
Apache HTTP Server 2.4.59 and earlier has an improper output escaping flaw in mod_rewrite. Substitutions in server context that use a backreference or variable as the first segment of the substitution can map URLs to filesystem locations that are served but not intentionally reachable by any URL. This can lead to code execution or source code disclosure.
Impact
An attacker can reach files that the server is permitted to serve but that are not meant to be directly URL-accessible, potentially executing code or disclosing source code.
Attack surface
Reachable over the network via HTTP requests to a server with an affected mod_rewrite configuration; the CVSS vector indicates no authentication and no user interaction are required.
Exploitation
CISA added this to the Known Exploited Vulnerabilities catalog on 2025-05-01, and EPSS shows a 30-day probability of 0.99957 (99.974th percentile), indicating active exploitation is expected.
What to do
- Upgrade Apache HTTP Server to a version later than 2.4.59 that contains the fix.
- Apply the vendor patch referenced in the Apache HTTP Server security advisory and the linked commit.
- Review mod_rewrite rules that use a backreference or variable as the first segment of a substitution in server context and constrain them appropriately.
- Avoid using the UnsafePrefixStat rewrite flag unless the substitution is verified to be safely constrained.
- For NetApp and SonicWall products that bundle the affected server, apply the respective vendor advisories.
Detection
- Monitor HTTP access logs for requests that resolve to filesystem paths not normally exposed by the application.
- Audit mod_rewrite configurations for substitutions beginning with a backreference or variable in server context.
- Watch for unexpected execution of files or disclosure of source code in web server responses.
- Correlate web server activity with CISA KEV guidance and vendor advisories for signs of exploitation attempts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2024-38475 to the Known Exploited Vulnerabilities catalog on 1 May 2025 as "Apache HTTP Server Improper Escaping of Output Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 22 May 2025.
Affected products
7 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities_24.html | Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20240712-0001/ | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2024/07/01/8 | Third Party Advisory |
| https://github.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cf | Patch |
| https://httpd.apache.org/security/vulnerabilities_24.html | Vendor Advisory |
| https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20240712-0001/ | Third Party Advisory |
| https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-a | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475 | Third Party AdvisoryUS Government Resource |
Track CVE-2024-38475 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-38475), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
