CVE-2023-25690
CriticalCVSS 9.8Summary
Some mod_proxy configurations on Apache HTTP Server 2.4.0 through 2.4.55 allow an HTTP Request Smuggling attack. This occurs when mod_proxy is combined with RewriteRule or ProxyPassMatch where a non-specific pattern matches part of the user-supplied URL and re-inserts it into the proxied request.
Risk Assessment
Attackers may bypass access controls in the proxy, proxy unintended URLs to origin servers, and poison caches. This can lead to unauthorized access and data exposure.
Recommendation
Update Apache HTTP Server to at least version 2.4.56. Review mod_proxy configurations using RewriteRule/ProxyPassMatch for unsafe patterns.
Other vulnerabilities in Apache HTTP Server
See all- CVE-2017-9798High
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27.
- CVE-2016-8743High
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. This acceptance of different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers.
- CVE-2016-5387High
Apache HTTP Server through 2.4.23 does not protect applications from untrusted client data in the HTTP_PROXY environment variable, allowing remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.
- CVE-2016-4979High
Apache HTTP Server versions 2.4.18 to 2.4.20, when mod_http2 and mod_ssl are enabled, improperly recognize the 'SSLVerifyClient require' directive for HTTP/2 request authorization. This allows remote attackers to bypass intended access restrictions.
- CVE-2024-40725Medium
A partial fix for CVE-2024-39884 in Apache HTTP Server 2.4.61 ignores some legacy content-type based configurations like AddType. Under certain circumstances with indirect file requests, this can lead to source code disclosure of local content.
- CVE-2024-36387Medium
Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
- CVE-2024-38477Medium
Null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.
- CVE-2023-38709Medium
Faulty input validation in the core of Apache HTTP Server through 2.4.58 allows malicious or exploitable backend/content generators to split HTTP responses, leading to HTTP response splitting attacks.
- CVE-2024-24795Medium
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.
- CVE-2024-27316Medium
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
Original NVD description (English source)
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS