New Vulnerability Discovered in Apache HTTP Server's Mod_Rewrite

What changed

The Apache HTTP Server has been found to have an improper escaping of output vulnerability in its mod_rewrite module. This flaw allows attackers to map URLs to filesystem locations that should not be accessible through standard URLs, potentially leading to code execution or the disclosure of sensitive source code.

Specifically, this issue affects Apache HTTP Server versions 2.4.59 and earlier, where substitutions that utilize backreferences or variables in the first segment of the substitution are particularly vulnerable.

Who is affected

This vulnerability impacts a wide range of users and organizations that rely on Apache HTTP Server for their web services.

Key affected groups include:

• Organizations using Apache HTTP Server version 2.4.59 or earlier.
• Web applications that implement mod_rewrite for URL manipulation.
• Developers relying on backreferences or variables in their RewriteRules.
• Any enterprise that has not yet updated to the latest version of the server.

What to do

To mitigate the risks associated with this vulnerability, it is crucial for administrators to update their Apache HTTP Server to the latest version as soon as possible.

Additionally, users should review their RewriteRules to ensure that they do not inadvertently expose sensitive filesystem locations.

• Upgrade to Apache HTTP Server version 2.4.60 or later to address the vulnerability.
• Audit existing RewriteRules for potential security issues.
• Consider using the "UnsafePrefixStat" rewrite flag cautiously, ensuring that all substitutions are properly constrained.