Apache HTTP Server up to 2.4.59 mod_rewrite server-side request forgery

Summaryinfo

A vulnerability, which was classified as critical, was found in Apache HTTP Server up to 2.4.59. This issue affects some unknown processing of the component mod_rewrite. Executing a manipulation can lead to server-side request forgery. This vulnerability is handled as CVE-2024-39573. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Apache HTTP Server up to 2.4.59 and classified as critical. This vulnerability affects some unknown functionality of the component mod_rewrite. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

The advisory is shared for download at lists.apache.org. This vulnerability was named CVE-2024-39573 since 06/25/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 01/04/2026).

The vulnerability scanner Nessus provides a plugin with the ID 209779 (EulerOS Virtualization 2.12.0 : httpd (EulerOS-SA-2024-2769)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.4.60 eliminates this vulnerability. The upgrade is hosted for download at httpd.apache.org.

The vulnerability is also documented in the databases at Tenable (209779) and CERT Bund (WID-SEC-2024-1504). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• IBM Tivoli Monitoring
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• F5 BIG-IP
• SUSE Linux
• IBM HTTP Server
• Oracle Linux
• Xerox FreeFlow Print Server
• Gentoo Linux
• Hitachi Ops Center
• IBM Business Automation Workflow
• Hitachi Configuration Manager
• RESF Rocky Linux
• IBM Rational ClearQuest
• Dell PowerScale OneFS
• Apache HTTP Server
• Dell NetWorker
• IBM Rational Build Forge
• HCL Commerce
• SonicWall SMA
• Dell ECS
• HPE HP-UX
• Red Hat JBoss Core Services
• Dell PowerProtect Data Domain

Productinfo

Type

• Web Server

Vendor

• Apache

Name

• HTTP Server

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.4.7
• 2.4.8
• 2.4.9
• 2.4.10
• 2.4.11
• 2.4.12
• 2.4.13
• 2.4.14
• 2.4.15
• 2.4.16
• 2.4.17
• 2.4.18
• 2.4.19
• 2.4.20
• 2.4.21
• 2.4.22
• 2.4.23
• 2.4.24
• 2.4.25
• 2.4.26
• 2.4.27
• 2.4.28
• 2.4.29
• 2.4.30
• 2.4.31
• 2.4.32
• 2.4.33
• 2.4.34
• 2.4.35
• 2.4.36
• 2.4.37
• 2.4.38
• 2.4.39
• 2.4.40
• 2.4.41
• 2.4.42
• 2.4.43
• 2.4.44
• 2.4.45
• 2.4.46
• 2.4.47
• 2.4.48
• 2.4.49
• 2.4.50
• 2.4.51
• 2.4.52
• 2.4.53
• 2.4.54
• 2.4.55
• 2.4.56
• 2.4.57
• 2.4.58
• 2.4.59

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion