Apache HTTP Server up to 2.4.55 mod_proxy_uwsgi request smuggling

Summaryinfo

A vulnerability was found in Apache HTTP Server up to 2.4.55 and classified as critical. The affected element is an unknown function of the component mod_proxy_uwsgi. The manipulation results in request smuggling. This vulnerability is reported as CVE-2023-27522. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Apache HTTP Server up to 2.4.55 (Web Server). Affected is an unknown code of the component mod_proxy_uwsgi. The manipulation with an unknown input leads to a request smuggling vulnerability. CWE is classifying the issue as CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

The weakness was disclosed 03/07/2023. The advisory is shared for download at httpd.apache.org. This vulnerability is traded as CVE-2023-27522 since 03/02/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/04/2026).

The vulnerability scanner Nessus provides a plugin with the ID 240002 (TencentOS Server 3: httpd:2.4 (TSSA-2023:0215)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.4.56 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (240002) and CERT Bund (WID-SEC-2023-0583). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• IBM Tivoli Monitoring
• Amazon Linux 2
• IBM Rational ClearQuest
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• IBM HTTP Server
• Oracle Linux
• IBM Security Access Manager for Enterprise Single Sign-On
• Red Hat JBoss Core Services
• Xerox FreeFlow Print Server
• IBM Business Automation Workflow
• IBM Rational ClearCase
• IBM QRadar SIEM
• IBM Power Hardware Management Console
• Apache HTTP Server
• Dell NetWorker
• IBM Rational Build Forge

Productinfo

Type

• Web Server

Vendor

• Apache

Name

• HTTP Server

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.4.7
• 2.4.8
• 2.4.9
• 2.4.10
• 2.4.11
• 2.4.12
• 2.4.13
• 2.4.14
• 2.4.15
• 2.4.16
• 2.4.17
• 2.4.18
• 2.4.19
• 2.4.20
• 2.4.21
• 2.4.22
• 2.4.23
• 2.4.24
• 2.4.25
• 2.4.26
• 2.4.27
• 2.4.28
• 2.4.29
• 2.4.30
• 2.4.31
• 2.4.32
• 2.4.33
• 2.4.34
• 2.4.35
• 2.4.36
• 2.4.37
• 2.4.38
• 2.4.39
• 2.4.40
• 2.4.41
• 2.4.42
• 2.4.43
• 2.4.44
• 2.4.45
• 2.4.46
• 2.4.47
• 2.4.48
• 2.4.49
• 2.4.50
• 2.4.51
• 2.4.52
• 2.4.53
• 2.4.54
• 2.4.55

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion