Skip to main content

Apache Releases Multiple Security Updates for HTTP Server

Nine vulnerabilities have been patched, including two that could allow information disclosure and three that could lead to remote code execution

Threat ID:
CC-4520
Threat Severity:
Medium
Published:
8 July 2024 3:59 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Nine vulnerabilities have been patched, including two that could allow information disclosure and three that could lead to remote code execution

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 2.4.61

Apache HTTP Server

Threat details

CVE-2024-38475 under active exploitation

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-38475 to the Known Exploited Vulnerabilities (KEV) catalogue.

HTTP Servers are regularly internet-facing by design and present an attractive target to facilitate initial access to an organisation's network. The NHS England National CSOC assesses further exploitation as likely.

Introduction

The Apache Software Foundation has released two updates to HTTP Server (sometimes known as 'httpd'), which address nine vulnerabilities. Apache HTTP Server is an open-source cross-platform web server implementation.

  • CVE-2024-39884 is a Source Code Disclosure vulnerability, which if exploited could allow an attacker to read the source code of scripts running on the server.
  • CVE-2024-38474 is an Improper Encoding or Escaping of Output vulnerability, which if exploited could allow a remote attacker to execute arbitrary code via scripts located in directories permitted by the Apache HTTP Server configuration but not directly accessible by any URL.
  • CVE-2024-38475 is an Improper Encoding or Escaping of Output vulnerability, which if exploited could allow a remote attacker to execute arbitrary code or disclose information.
  • CVE-2024-38476 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability, which if exploited by an attacker could lead to information disclosure, arbitrary code execution, or server-side request forgery (SSRF). 

Threat updates

Date Update
2 May 2025 CVE-2024-38475 added to CISA's Known Exploited Vulnerabilities catalogue

Remediation advice

Affected organisations are encouraged to review the release notes for Apache HTTP Server 2.4.60 and Apache HTTP Server 2.4.61 on the Apache HTTP Server 2.4 vulnerabilities webpage and apply any relevant updates.  

Note: Updating to Apache HTTP Server 2.4.61 will remediate all nine vulnerabilities. Organisations are strongly encouraged to update to version 2.4.61.

CVE Vulnerabilities

Status Published

CVE-2024-39884

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers.   "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.
Status Published

CVE-2024-38474

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
Status Published

CVE-2024-38475

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
Status Published

CVE-2024-38476

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Last edited: 2 May 2025 11:37 am