Vulnerability in Apache HTTP Server
CVE-2023-25690
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.
Vulnerability class: HTTP Request Smuggling
EPSS: 0.845 (99.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Http_server
- Apache Software Foundation Http Server — versions 2.4.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Vendor Advisory)
- security@apache.org
- security@apache.org
- security@apache.org
Frequently asked questions
- What is CVE-2023-25690?
- CVE-2023-25690 is a critical-severity vulnerability in Apache HTTP Server, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 9.8/10. Published 2023-03-07.
- How severe is CVE-2023-25690?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2023-25690 known to be exploited?
- 57 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.