CVE-2024-38475

9.1

CRITICAL

Apache HTTP Server Improper Escaping of Output Vul - [Actively Exploited]

Description

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

INFO

Published Date :

July 1, 2024, 7:15 p.m.

Last Modified :

May 2, 2025, 3:43 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.2

Exploitability Score :

3.9

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: May 22, 2025

Alert Date: May 01, 2025 | 94 days ago

Description :

Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://httpd.apache.org/security/vulnerabilities_24.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-38475

Public PoC/Exploit Available at Github

CVE-2024-38475 has a 16 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-38475 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Apache	http_server
1	Netapp	ontap_9

: Total Affected Vendor : 2 | Products : 2

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-38475.

URL	Resource
https://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240712-0001/	Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/07/01/8	Third Party Advisory
https://github.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cf	Patch
https://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
https://security.netapp.com/advisory/ntap-20240712-0001/	Third Party Advisory
https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227	Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

dusbot/cpe2cve

A tool written in Go that queries CVE information using CPE (Common Platform Enumeration) as input, with support for library integration（使用go实现的一个根据cpe查询cve信息的工具，支持库调用）

Updated: 4 weeks, 2 days ago

4 stars 1 fork 1 watcher

Born at : June 25, 2025, 2:52 a.m. This repo has been linked 70 different CVEs too.

syaifulandy/CVE-2024-38475

CVE-2024-38475 Scanner using FFUF + Seclists

Shell

Updated: 2 months, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : May 9, 2025, 7:51 a.m. This repo has been linked 1 different CVEs too.

abrewer251/CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC

None

Python

Updated: 2 months, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : May 7, 2025, 12:02 a.m. This repo has been linked 1 different CVEs too.

watchtowrlabs/watchTowr-vs-SonicWall-PreAuth-RCE-Chain

None

Python

Updated: 2 months ago

16 stars 3 fork 3 watcher

Born at : May 1, 2025, 9:02 p.m. This repo has been linked 2 different CVEs too.

plzheheplztrying/cve_monitor

None

HTML Python Shell

Updated: 4 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 13, 2025, 8:50 a.m. This repo has been linked 891 different CVEs too.

M0rPH3U53/Massap

Accélération de la vitesse de scan de ports en combinant Nmap & Masscan

Shell

Updated: 5 months, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : Feb. 3, 2025, 9:11 p.m. This repo has been linked 67 different CVEs too.

NeoOniX/5ATTACK

None

Updated: 6 months ago

0 stars 0 fork 0 watcher

Born at : Jan. 30, 2025, 9:01 a.m. This repo has been linked 173 different CVEs too.

Y09a514/Test-Apache-Vulnerability

Alat sederhana Uji Kerentanan Server HTTP Apache

Python

Updated: 3 weeks, 4 days ago

1 stars 0 fork 0 watcher

Born at : Jan. 23, 2025, 8:11 a.m. This repo has been linked 8 different CVEs too.

opendr-io/causality

A repo for output of an intrusion prediction project

Jupyter Notebook

Updated: 3 weeks, 2 days ago

8 stars 1 fork 1 watcher

Born at : Jan. 4, 2025, 1:44 a.m. This repo has been linked 34 different CVEs too.

soltanali0/CVE-2024-38475

exploit CVE-2024-38475(mod_rewrite weakness with filesystem path matching)

Python

Updated: 7 months, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : Dec. 12, 2024, 10:23 a.m. This repo has been linked 1 different CVEs too.

krlabs/apache-vulnerabilities

Apache Web Server Vulnerabilities list

apache cve vulnerabilities

Updated: 7 months ago

0 stars 0 fork 0 watcher

Born at : Nov. 30, 2024, 7:36 p.m. This repo has been linked 47 different CVEs too.

ums91/CISA_BOT

CISA Bot is a GitHub bot that automatically monitors the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog. When new vulnerabilities are published in the KEV, the bot creates GitHub issues in this repository with detailed information about each vulnerability.

Python

Updated: 6 days ago

2 stars 0 fork 0 watcher

Born at : Oct. 29, 2024, 10:19 a.m. This repo has been linked 191 different CVEs too.

mrmtwoj/apache-vulnerability-testing

Apache HTTP Server Vulnerability Testing Tool | PoC for CVE-2024-38472 , CVE-2024-39573 , CVE-2024-38477 , CVE-2024-38476 , CVE-2024-38475 , CVE-2024-38474 , CVE-2024-38473 , CVE-2023-38709

apache apache2 cve-2023-3870 cve-2024-38472 cve-2024-38473 cve-2024-38474 cve-2024-38475 cve-2024-38476 cve-2024-38477 cve-2024-39573

Python

Updated: 2 weeks ago

98 stars 17 fork 17 watcher

Born at : Oct. 5, 2024, 8:32 p.m. This repo has been linked 8 different CVEs too.

p0in7s/CVE-2024-38475

None

Python

Updated: 1 month, 2 weeks ago

14 stars 3 fork 3 watcher

Born at : Aug. 18, 2024, 11:30 a.m. This repo has been linked 1 different CVEs too.

Ostorlab/KEV

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 2 days, 6 hours ago

578 stars 42 fork 42 watcher

Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1286 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-38475 vulnerability anywhere in the article.

BleepingComputer

SonicWall urges admins to patch critical RCE flaw in SMA 100 devices

SonicWall urges customers to patch SMA 100 series appliances against a critical authenticated arbitrary file upload vulnerability that can let attackers gain remote code execution. The security flaw ( ...

Published Date: Jul 24, 2025 (1 week, 3 days ago)

CVE-2025-40599 CVE-2025-32821 CVE-2025-32820 CVE-2025-32819 CVE-2024-38475 CVE-2021-20039 CVE-2021-20038 CVE-2021-20035

Daily CyberSecurity

SonicWall SMA Devices Under Attack: UNC6148 Deploys OVERSTEP Rootkit for Persistent Access

Google’s Threat Intelligence Group (GTIG) uncovers a stealthy, sophisticated campaign led by a financially motivated actor tracked as UNC6148. This campaign targets end-of-life SonicWall Secure Mobile ...

Published Date: Jul 17, 2025 (2 weeks, 3 days ago)

CVE-2025-20337 CVE-2024-38475 CVE-2023-44221 CVE-2021-20038 CVE-2021-20035

Ars Technica

Google finds custom backdoor being installed on SonicWall network devices

Researchers from the Google Threat Intelligence Group said that hackers are compromising SonicWall Secure Mobile Access (SMA) appliances, which sit at the edge of enterprise networks and manage and se ...

Published Date: Jul 16, 2025 (2 weeks, 3 days ago)

CVE-2025-32819 CVE-2024-38475 CVE-2021-20039 CVE-2021-20038 CVE-2021-20035

Help Net Security

SonicWall SMA devices persistently infected with stealthy OVERSTEP backdoor and rootkit

Unknown intruders are targeting fully patched end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances and deploying a novel, persistent backdoor / rootkit, analysts with Google’s Threat ...