erroneo.us
Search all guides⌘K

Security Digest · Jul 1, 2024 · Vulnerability · Web framework

Apache httpd CVE-2024-38475: mod_rewrite Flaw Hit SMA100

A mod_rewrite flaw fixed in Apache httpd 2.4.60 was exploited via SonicWall SMA100 appliances. Stock httpd is exposed only with certain rewrite rules.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

For ordinary Apache servers this only matters if a server-level RewriteRule starts its target with a backreference or variable, and 2.4.60+ fixes it; the real-world damage was on SonicWall SMA100 appliances, which are now unsupported and should be retired and investigated.

Who must act: Owners of SonicWall SMA 100 appliances, and admins of Apache 2.4.59 or earlier whose server or virtual-host config has RewriteRule substitutions beginning with $1, /$1 or %{...}.

Who can relax: Apache servers on 2.4.60 or later (or a distro build with the fix), and servers whose rewrite rules all start the substitution with a fixed path.

Affected
Apache HTTP Server 2.4.0 through 2.4.59 with affected server-context RewriteRules
SonicWall SMA 100 Series (SMA 200, 210, 400, 410, 500v) 10.2.1.13-72sv and earlier
Fixed in
Apache HTTP Server 2.4.60 (Jul 1, 2024); current release 2.4.69 (Oct 1, 2026)
SonicWall SMA 100 firmware 10.2.1.14-75sv (Dec 4, 2024); the product reached end of support Nov 1, 2025
CVSS
9.1 (v3.1, NVD)
EPSS
100.0% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Check each Apache build with httpd -v or apache2 -v and upgrade to a current 2.4.x release or your distribution's patched package.
  2. Review RewriteRule lines in server and virtual-host config; constrain any rule whose substitution begins with a backreference or variable, and only add the UnsafePrefixStat flag after that.
  3. Ask vendors of appliances that embed Apache httpd whether their firmware includes the fix.
  4. Retire SonicWall SMA 100 appliances; SonicWall ended support on November 1, 2025.
  5. Before retiring an SMA 100, image it, then reset every user password and OTP binding it held and reissue certificates whose keys lived on it.

How to check if you are affected or compromised

  • On SMA 100 disk images, check whether /etc/ld.so.preload has content and look for libsamba-errors.so.6, which GTIG ties to the OVERSTEP rootkit.
  • Search SMA 100 and proxy logs for admin VPN sessions from unexpected IPs and for URLs containing dobackshell or dopasswords.
  • On general Apache servers, review access logs for requests carrying an encoded question mark (%3F) on rewritten URLs that returned files you do not expect to serve.
  • Look for unexpected 'Current settings exported/imported' or 'Clear all logs manually' entries on SMA 100 appliances.

What happened#

On July 1, 2024, Apache HTTP Server 2.4.60 fixed CVE-2024-38475, one of several bugs Orange Tsai of DEVCORE reported on April 1 and later presented as "Confusion Attacks." Per Apache's advisory, improper escaping in mod_rewrite lets an attacker map URLs to files the server may serve but that no URL is meant to reach. The result can be source code disclosure or code execution. Apache rates it "important." NVD and CISA score it CVSS 3.1 9.1.

The exploitation came through SonicWall's SMA 100 VPN appliances, which bundle Apache with a vulnerable rewrite rule. SonicWall fixed it in firmware 10.2.1.14-75sv on December 4, 2024, under SNWLID-2024-0018. On April 29, 2025, it added that the bug could enable session hijacking and was "potentially being exploited in the wild." On May 1, watchTowr showed the bug leaking an active admin session, then chained with authenticated command injection CVE-2023-44221 to run commands. CISA added both to KEV that day, as The Hacker News reported. In July 2025, Google's GTIG described UNC6148 planting the OVERSTEP rootkit on SMA 100s with stolen admin credentials. It named this CVE as a likely source of those credentials and OTP seeds, though Mandiant could not confirm it.

Who is affected#

Apache 2.4.0 through 2.4.59, but only with a specific configuration. The CVE record limits it to "substitutions in server context that use backreferences or variables as the first segment of the substitution." A default install has no such rule. The risk comes from custom configs and from appliances that embed httpd. The fix breaks some unsafe rules, and Apache provides the UnsafePrefixStat flag to opt back in once a rule is constrained. On SonicWall, SMA 200, 210, 400, 410 and 500v up to 10.2.1.13-72sv are affected. SonicWall says SMA 100 reached end of support on November 1, 2025.

Do you really need to act?#

For most Apache admins, no urgent action is needed. 2.4.60 is more than two years old, and the current release is 2.4.69. Confirm your version and audit your rewrite rules once. For SMA 100 owners, yes. The devices are unsupported, and GTIG warns that credentials and OTP seeds stolen before patching still work afterwards.

What to do now#

  1. Run httpd -v or apache2 -v and upgrade, or confirm your distribution's package carries the fix.
  2. List rules with grep -rn RewriteRule /etc/httpd /etc/apache2. Constrain any server-level rule whose target begins with $1, /$1 or %{...}.
  3. Ask appliance vendors whether their embedded httpd is fixed.
  4. Retire SMA 100s. First image them, then reset every password and OTP binding they held.

How to tell if you were hit#

On SMA 100 disk images, check whether /etc/ld.so.preload has content and look for libsamba-errors.so.6. Search logs for admin VPN sessions from unexpected IPs and for URLs containing dobackshell or dopasswords. On ordinary Apache servers, review access logs for an encoded %3F on rewritten URLs that returned files you never meant to serve.

Timeline#

  • — Orange Tsai reports the bug to Apache.
  • — Apache 2.4.60 ships the fix.
  • — SonicWall releases SMA 100 firmware 10.2.1.14-75sv.
  • — SonicWall warns of possible exploitation.
  • — watchTowr publishes the chain, and CISA adds both CVEs to KEV.
  • — GTIG reports the OVERSTEP campaign.
  • — SMA 100 reaches end of support.

Vulnerability records

  • CVE-2024-38475 · KEV 2025-05-01 · Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Apache HTTP Server — Apache HTTP Server 2.4 vulnerabilities httpd.apache.org
  2. CVE record — CVE-2024-38475 cve.org
  3. NVD — CVE-2024-38475 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2024-38475 cisa.gov
  5. SonicWall PSIRT — SNWLID-2024-0018: SonicWall SMA100 SSL-VPN Affected By Multiple Vulnerabilities psirt.global.sonicwall.com
  6. DEVCORE (Orange Tsai) — Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server devco.re
  7. watchTowr Labs — SonicBoom, From Stolen Tokens to Remote Shells - SonicWall SMA (CVE-2023-44221, CVE-2024-38475) labs.watchtowr.com
  8. Google Threat Intelligence Group — Ongoing SonicWall SMA Exploitation Campaign using the OVERSTEP Backdoor cloud.google.com
  9. SonicWall — SMA100: 10.2.2.4 Released to Support License Manager Upgrades (end-of-support notice) sonicwall.com
  10. CVE record — CVE-2023-44221 cve.org

Coverage and analysis

  1. The Hacker News — SonicWall Confirms Active Exploitation of Flaws Affecting Multiple Appliance Models thehackernews.com