CVE-2024-38475 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2024-07-01

Added to CISA KEV: 2025-05-01 304 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review Apache access logs for suspicious URL patterns, check for unauthorized file access, verify web application integrity, and scan for potential web shells or unauthorized code
Immediately upgrade Apache HTTP Server to version 2.4.60 or later
Review and audit all mod_rewrite rules, especially those using backreferences or variables as the first segment of substitution
If immediate patching is not possible, disable mod_rewrite or implement the 'UnsafePrefixStat' flag with extreme caution after ensuring substitutions are properly constrained
Implement web application firewalls (WAF) with rules to detect path traversal attempts
Monitor Apache access logs for unusual URL patterns and filesystem access attempts

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2024-38475 is a critical vulnerability in the Apache HTTP Server that allows for unauthorized access to filesystem locations, potentially leading to source code disclosure or arbitrary code execution ^[1] ^[4].

Key Details of CVE-2024-38475

Feature	Description
Vulnerability Type	Improper escaping of output in `mod_rewrite` ^[1]
Affected Versions	Apache HTTP Server 2.4.59 and earlier ^[1]
CVSS Score	9.1 (Critical) ^[3]
Attack Vector	Network (Remote) ^[4]
User Interaction	None required ^[4]

Exploitation and Impact

Attack Method: An attacker can send specially crafted HTTP requests to exploit the improper escaping in `mod_rewrite`. This allows the attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intended to be directly reachable via a URL ^[1].
Impact: Successful exploitation can result in the disclosure of sensitive source code or, in certain configurations, arbitrary code execution ^[1].
Active Exploitation: This vulnerability has been added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog, confirming that it has been exploited in the wild ^[3].

Mitigation and Patch Status

Patching: Users should upgrade to a version of Apache HTTP Server that addresses this vulnerability (typically versions 2.4.60 or later).
Configuration: The vulnerability specifically affects substitutions in the server context that use backreferences or variables as the first segment of the substitution ^[2]. If upgrading is not immediately possible, administrators can use the `UnsafePrefixStat` rewrite flag to constrain substitutions, though this is a temporary measure and patching is strongly recommended ^[2].

Sources

NVD - CVE-2024-38475
CVE-2024-38475 Detail Description Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execut…
CVE-2024-38475 - Vulnerability Details - OpenCVE
Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately const…
Apache HTTP Server Improper Escaping of Output Vulnerability ...
CVE-2024-38475 is a vulnerability affecting Apache HTTP Servers with a CVSS score of 9.1. By sending specially crafted HTTP requests, this flaw allows remote ...
CVE-2024-38475 - Exploits & Severity - Feedly
The vulnerability CVE-2024-38475 in Apache HTTP Server's mod_rewrite allows an attacker to exploit weaknesses in the substitution matching filesystem paths, potentially leading to unauthorized access or other malicious activities. ... CVEs. CVE-2024-38475. Proof of exploitExploited in the wild.This…