Nine vulnerabilities have been patched, including two that could allow information disclosure and three that could lead to remote code execution

Threat ID:CC-4520

Threat Severity:Medium

Published:8 July 2024 3:59 PM

Summary

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 2.4.61

Apache HTTP Server

Threat details

Introduction

The Apache Software Foundation has released two updates to HTTP Server (sometimes known as 'httpd'), which address nine vulnerabilities. Apache HTTP Server is an open-source cross-platform web server implementation.

CVE-2024-39884 is a Source Code Disclosure vulnerability, which if exploited could allow an attacker to read the source code of scripts running on the server.

CVE-2024-38474 is an Improper Encoding or Escaping of Output vulnerability, which if exploited could allow a remote attacker to execute arbitrary code via scripts located in directories permitted by the Apache HTTP Server configuration but not directly accessible by any URL.

CVE-2024-38475 is an Improper Encoding or Escaping of Output vulnerability, which if exploited could allow a remote attacker to execute arbitrary code or disclose information.

CVE-2024-38476 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability, which if exploited by an attacker could lead to information disclosure, arbitrary code execution, or server-side request forgery (SSRF).

Likely exploitation of Apache HTTP Server

HTTP Servers are regularly internet-facing by design and present an attractive target to facilitate initial access to an organisation's network. Vulnerabilities in internet-facing servers are often exploited soon after official disclosure and broader exploitation is expected.

Remediation advice

Affected organisations are encouraged to review the release notes for Apache HTTP Server 2.4.60 and Apache HTTP Server 2.4.61 on the Apache HTTP Server 2.4 vulnerabilities webpage and apply any relevant updates.

Note: Updating to Apache HTTP Server 2.4.61 will remediate all nine vulnerabilities. Organisations are strongly encouraged to update to version 2.4.61.

Definitive source of threat updates

https://httpd.apache.org/security/vulnerabilities_24.html

CVE Vulnerabilities

StatusPublished

CVE-2024-39884A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.

StatusPublished

CVE-2024-38474Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.

StatusPublished

CVE-2024-38475Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

StatusPublished

CVE-2024-38476Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Last edited: 8 July 2024 3:59 pm