Internet Bug Bounty: important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)

2024-07-0306:56:04

orange

hackerone.com

$4920

internet bug bounty

apache http server

cve-2024-38476

vulnerability

information disclosure

ssrf

local script execution

upgrade

fix

addtype directive

sethandler

version 2.4.60.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.018

Percentile

88.5%

JSON

I reported this vulnerability through the official Apache HTTP Server security email on April 1, 2024, and received a fix along with a CVE number on July 1, 2024. You can check detailed information from there:
> https://httpd.apache.org/security/vulnerabilities_24.html

Impact

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Note: Some legacy uses of the ‘AddType’ directive to connect a request to a handler must be ported to ‘SetHandler’ after this fix.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.