CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
A vulnerability was found in httpd. This security issue occurs when some modproxy configurations on Apache HTTP Server allow an HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution.
Other sources
Some modproxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.
Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like:
RewriteEngine on RewriteRule "^/here/(.)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/
Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.
— MITRE
Some modproxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution.
References: https://httpd.apache.org/security/vulnerabilities24.html https://www.openwall.com/lists/oss-security/2023/03/07/1
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.51-39.el8 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.51-39.el7 - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 0:2.4.6-98.el7_9.7 - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 0:2.4.53-7.el9_1.5 - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 0:2.4.51-7.el9_0.4 - Upgrade
Upgrade
redhat/httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.34-23.el7.6 - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.56 - Upgrade
Upgrade
httpd (Apache HTTP Server)to a version that resolves this vulnerability.Fixed in 2.4.56 - Compensating control
If upgrading to Apache HTTP Server 2.4.56+ is not immediately possible, review configurations that have mod_proxy enabled combined with RewriteRule/ProxyPassMatch, and avoid non-specific patterns that match user-supplied request-target data which is then re-inserted into the proxied request-target via variable substitution (e.g., RewriteRule or ProxyPassMatch patterns that can cause request splitting/smuggling behavior).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-25690?
CVE-2023-25690 is a vulnerability found in httpd, specifically in mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55.
How severe is CVE-2023-25690?
CVE-2023-25690 has a severity rating of critical (9 out of 10).
Which software versions are affected by CVE-2023-25690?
CVE-2023-25690 affects Apache HTTP Server versions 2.4.0 through 2.4.55, jbcs-httpd24-httpd versions 2.4.51-39.el8 and 2.4.51-39.el7, httpd version 2.4.6-98.el7_9.7, and httpd versions 2.4.53-7.el9_1.5 and 2.4.51-7.el9_0.4.
How can I fix CVE-2023-25690?
To fix CVE-2023-25690, it is recommended to update to the latest patched versions of the affected software mentioned in the advisory.
Where can I find more information about CVE-2023-25690?
More information about CVE-2023-25690 can be found on the official CVE website, NIST NVD, Apache HTTP Server security vulnerabilities page, and the Red Hat Bugzilla and Errata pages.